theory CSpace_R

lemma cteMove_corres:
  assumes cr: "cap_relation cap cap'"
  notes trans_state_update'[symmetric,simp]
  shows
  "corres dc (einvs and
              cte_at ptr and
              cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and
              valid_cap cap and tcb_cap_valid cap ptr' and K (ptr \<noteq> ptr'))
             (invs' and
              cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> NullCap) (cte_map ptr) and
              cte_wp_at' (\<lambda>c. cteCap c = NullCap) (cte_map ptr'))
          (cap_move cap ptr ptr') (cteMove cap' (cte_map ptr) (cte_map ptr'))"
  (is "corres _ ?P ?P' _ _") supply subst_all [simp del] apply (simp add: cap_move_def cteMove_def const_def) apply (rule corres_symb_exec_r) defer apply (rule getCTE_sp) apply wp apply (rule no_fail_pre, wp) apply (clarsimp simp add: cte_wp_at_ctes_of) apply (rule corres_assert_assume) prefer 2 apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule corres_assert_assume) prefer 2 apply clarsimp apply (drule invs_mdb') apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def) apply (case_tac oldCTE) apply (clarsimp simp: valid_nullcaps_def initMDBNode_def) apply (erule allE)+ apply (erule (1) impE) apply (clarsimp simp: nullPointer_def) apply (rule corres_symb_exec_r) defer apply (rule getCTE_sp) apply wp apply (rule no_fail_pre, wp) apply (clarsimp simp add: cte_wp_at_ctes_of) apply (rule corres_no_failI) apply (rule no_fail_pre, wp hoare_weak_lift_imp) apply (clarsimp simp add: cte_wp_at_ctes_of) apply (drule invs_mdb') apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def) apply (rule conjI) apply clarsimp apply (erule (2) valid_dlistEp, simp) apply clarsimp apply (erule (2) valid_dlistEn, simp) apply (clarsimp simp: in_monad state_relation_def) apply (clarsimp simp: cte_wp_at_ctes_of) apply (case_tac oldCTE) apply (rename_tac x old_dest_node) apply (case_tac cte) apply (rename_tac src_cap src_node) apply clarsimp apply (subgoal_tac "\<exists>c. caps_of_state a ptr = Some c") prefer 2 apply (clarsimp simp: cte_wp_at_caps_of_state) apply clarsimp apply (subgoal_tac "cap_relation c src_cap") prefer 2 apply (drule caps_of_state_cteD) apply (drule (1) pspace_relation_ctes_ofI) apply fastforce apply fastforce apply fastforce apply (drule (1) pspace_relationsD) apply (drule_tac p=ptr' in set_cap_not_quite_corres, assumption+) apply fastforce apply fastforce apply fastforce apply (erule cte_wp_at_weakenE, rule TrueI) apply fastforce apply fastforce apply assumption apply fastforce apply (rule cr) apply (rule refl) apply (clarsimp simp: split_def) apply (rule bind_execI, assumption) apply (drule_tac p=ptr and c="cap.NullCap" in set_cap_not_quite_corres') apply assumption+ apply (frule use_valid [OF _ set_cap_valid_objs]) apply fastforce apply assumption apply (frule use_valid [OF _ set_cap_aligned]) apply fastforce apply assumption apply (frule use_valid [OF _ set_cap_distinct]) apply fastforce apply assumption apply (frule use_valid [OF _ set_cap_cte_at]) prefer 2 apply assumption apply assumption apply (drule updateCap_stuff) apply (elim conjE mp, fastforce) apply (drule updateCap_stuff) apply (elim conjE mp, fastforce) apply assumption apply simp apply simp apply (rule refl) apply clarsimp apply (rule bind_execI, assumption) apply(subgoal_tac "mdb_move_abs ptr ptr' (cdt a) a") apply (frule mdb_move_abs'.intro) prefer 2 apply(rule mdb_move_abs.intro) apply(clarsimp) apply(fastforce elim!: cte_wp_at_weakenE) apply(simp) apply(simp) apply (clarsimp simp: exec_gets exec_get exec_put set_cdt_def
                        set_original_def bind_assoc modify_def
         |(rule bind_execI[where f="cap_move_ext x y z x'" for x y z x'], clarsimp simp: mdb_move_abs'.cap_move_ext_det_def2 update_cdt_list_def set_cdt_list_def put_def) | rule refl )+ apply (clarsimp simp: put_def) apply (clarsimp simp: invs'_def valid_state'_def) apply (frule updateCap_dynamic_duo, fastforce, fastforce) apply (frule(2) updateCap_dynamic_duo [OF _ conjunct1 conjunct2]) apply (subgoal_tac "no_0 (ctes_of b)") prefer 2 apply fastforce apply (frule(1) use_valid [OF _ updateCap_no_0]) apply (frule(2) use_valid [OF _ updateCap_no_0, OF _ use_valid [OF _ updateCap_no_0]]) apply (elim conjE) apply (drule (5) updateMDB_the_lot', elim conjE) apply (drule (4) updateMDB_the_lot, elim conjE) apply (drule (4) updateMDB_the_lot, elim conjE) apply (drule (4) updateMDB_the_lot, elim conjE) apply (drule updateCap_stuff, elim conjE, erule (1) impE) apply (drule updateCap_stuff) apply (subgoal_tac "pspace_distinct' b \<and> pspace_aligned' b") prefer 2 apply (elim valid_pspaceE' conjE) apply (rule conjI; assumption) apply (simp only: ) apply (thin_tac "ctes_of t = s" for t s)+ apply (thin_tac "ksMachineState t = p" for t p)+ apply (thin_tac "ksCurThread t = p" for t p)+ apply (thin_tac "ksIdleThread t = p" for t p)+ apply (thin_tac "ksReadyQueues t = p" for t p)+ apply (thin_tac "ksSchedulerAction t = p" for t p)+ apply (subgoal_tac "\<forall>p. cte_at p ta = cte_at p a") prefer 2 subgoal by (simp add: set_cap_cte_eq) apply (clarsimp simp add: swp_def cte_wp_at_ctes_of simp del: split_paired_All) apply (subgoal_tac "cte_at ptr' a") prefer 2 apply (erule cte_wp_at_weakenE, rule TrueI) apply (subgoal_tac "cte_map ptr \<noteq> cte_map ptr'") prefer 2 apply (erule (2) cte_map_inj) apply fastforce apply fastforce apply fastforce apply (clarsimp simp: pspace_relations_def) apply (rule conjI) apply (clarsimp simp: ghost_relation_typ_at set_cap_a_type_inv data_at_def) apply (thin_tac "gsCNodes t = p" for t p)+ apply (thin_tac "ksMachineState t = p" for t p)+ apply (thin_tac "ksCurThread t = p" for t p)+ apply (thin_tac "ksWorkUnitsCompleted t = p" for t p)+ apply (thin_tac "ksIdleThread t = p" for t p)+ apply (thin_tac "ksReadyQueues t = p" for t p)+ apply (thin_tac "ksSchedulerAction t = p" for t p)+ apply (thin_tac "cur_thread t = p" for t p)+ apply (thin_tac "domain_index t = p" for t p)+ apply (thin_tac "domain_time t = p" for t p)+ apply (thin_tac "cur_domain t = p" for t p)+ apply (thin_tac "scheduler_action t = p" for t p)+ apply (thin_tac "ready_queues t = p" for t p)+ apply (thin_tac "idle_thread t = p" for t p)+ apply (thin_tac "machine_state t = p" for t p)+ apply (thin_tac "work_units_completed t = p" for t p)+ apply (thin_tac "ksArchState t = p" for t p)+ apply (thin_tac "gsUserPages t = p" for t p)+ apply (thin_tac "ksCurDomain t = p" for t p)+ apply (thin_tac "ksInterruptState t = p" for t p)+ apply (thin_tac "ksDomScheduleIdx t = p" for t p)+ apply (thin_tac "ksDomainTime t = p" for t p)+ apply (thin_tac "ksDomSchedule t = p" for t p)+ apply (thin_tac "ctes_of t = p" for t p)+ apply (thin_tac "ekheap_relation t p" for t p)+ apply (thin_tac "pspace_relation t p" for t p)+ apply (thin_tac "interrupt_state_relation s t p" for s t p)+ apply (thin_tac "ghost_relation s t p" for s t p)+ apply (thin_tac "sched_act_relation t p" for t p)+ apply (thin_tac "ready_queues_relation t p" for t p)+ apply (subst conj_assoc[symmetric]) apply (rule conjI) defer apply (drule set_cap_caps_of_state_monad)+ apply (simp add: modify_map_mdb_cap) apply (simp add: modify_map_apply) apply (clarsimp simp add: revokable_relation_def simp del: fun_upd_apply) apply simp apply (rule conjI) apply clarsimp apply (erule_tac x="fst ptr" in allE) apply (erule_tac x="snd ptr" in allE) apply simp apply (erule impE) subgoal by (clarsimp simp: cte_wp_at_caps_of_state null_filter_def split: if_split_asm) apply simp apply clarsimp apply (subgoal_tac "null_filter (caps_of_state a) (aa,bb) \<noteq> None") prefer 2 subgoal by (clarsimp simp only: null_filter_def cap.simps option.simps
                               fun_upd_def simp_thms
          split: if_splits) apply clarsimp apply (subgoal_tac "cte_at (aa,bb) a") prefer 2 apply (drule null_filter_caps_of_stateD) apply (erule cte_wp_cte_at) apply (frule_tac p="(aa,bb)" and p'="ptr'" in cte_map_inj, assumption+) apply fastforce apply fastforce apply fastforce apply (clarsimp split: if_split_asm) apply (subgoal_tac "(aa,bb) \<noteq> ptr") apply (frule_tac p="(aa,bb)" and p'="ptr" in cte_map_inj, assumption+) apply fastforce apply fastforce apply fastforce apply clarsimp subgoal by (simp add: null_filter_def split: if_splits) apply (subgoal_tac "mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node") prefer 2 apply (rule mdb_move.intro) apply (rule mdb_ptr.intro) apply (rule vmdb.intro) apply (simp add: valid_pspace'_def valid_mdb'_def) apply (erule mdb_ptr_axioms.intro) apply (rule mdb_move_axioms.intro) apply assumption apply (simp add: nullPointer_def) apply (simp add: nullPointer_def) apply (erule weak_derived_sym') apply clarsimp apply assumption apply (rule conjI) apply (simp (no_asm) add: cdt_relation_def) apply clarsimp apply (subst mdb_move.descendants, assumption) apply (subst mdb_move_abs.descendants[simplified fun_upd_apply]) apply (rule mdb_move_abs.intro) apply fastforce apply (fastforce elim!: cte_wp_at_weakenE) apply simp apply simp apply (case_tac "(aa,bb) = ptr", simp) apply (subgoal_tac "cte_map (aa,bb) \<noteq> cte_map ptr") prefer 2 apply (erule (2) cte_map_inj, fastforce, fastforce, fastforce) apply (case_tac "(aa,bb) = ptr'") apply (simp add: cdt_relation_def del: split_paired_All) apply (subgoal_tac "cte_map (aa,bb) \<noteq> cte_map ptr'") prefer 2 apply (erule (2) cte_map_inj, fastforce, fastforce, fastforce) apply (simp only: if_False) apply simp apply (subgoal_tac "descendants_of' (cte_map (aa, bb)) (ctes_of b) =
                       cte_map ` descendants_of (aa, bb) (cdt a)") prefer 2 subgoal by (simp add: cdt_relation_def del: split_paired_All) apply simp apply (rule conjI) apply clarsimp apply (subst inj_on_image_set_diff15) apply (rule inj_on_descendants_cte_map) apply fastforce apply fastforce apply fastforce apply fastforce apply (rule subset_refl) subgoal by simp subgoal by simp apply clarsimp apply (drule (1) cte_map_inj_eq) apply (erule descendants_of_cte_at) apply fastforce apply fastforce apply fastforce apply fastforce subgoal by clarsimp apply(clarsimp simp: cdt_list_relation_def) apply(subst next_slot_eq2) apply(simp split: option.splits) apply(intro conjI impI) apply(rule mdb_move_abs'.next_slot_no_parent) apply(simp, fastforce, simp) apply(intro allI impI) apply(rule mdb_move_abs'.next_slot) apply(simp, fastforce, simp) subgoal by(fastforce split: option.splits) apply(case_tac "ctes_of b (cte_map (aa, bb))") subgoal by (clarsimp simp: modify_map_def split: if_split_asm) apply(case_tac ab) apply(frule mdb_move.m'_next) apply(simp, fastforce) apply(case_tac "(aa, bb) = ptr") apply(simp) apply(case_tac "(aa, bb) = ptr'") apply(case_tac "next_slot ptr (cdt_list (a)) (cdt a)") subgoal by(simp) apply(simp) apply(erule_tac x="fst ptr" in allE) apply(erule_tac x="snd ptr" in allE) subgoal by(clarsimp split: if_split_asm) apply(frule invs_mdb, frule invs_valid_pspace) apply(frule finite_depth) apply simp apply(case_tac "next_slot (aa, bb) (cdt_list (a)) (cdt a) = Some ptr") apply(frule(3) cte_at_next_slot) apply(erule_tac x=aa in allE, erule_tac x=bb in allE) subgoal by (clarsimp simp: cte_map_inj_eq valid_pspace_def split: if_split_asm) apply(simp) apply(case_tac "next_slot (aa, bb) (cdt_list (a)) (cdt a)") subgoal by(simp) apply(frule(3) cte_at_next_slot) apply(frule(3) cte_at_next_slot') apply(erule_tac x=aa in allE, erule_tac x=bb in allE) by(clarsimp simp: cte_map_inj_eq valid_pspace_def split: if_split_asm)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and K (ptr \<noteq> ptr')) (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) (cap_move cap ptr ptr') (cteMove cap' (cte_map ptr) (cte_map ptr')) proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and K (ptr \<noteq> ptr')) (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) (cap_move cap ptr ptr') (cteMove cap' (cte_map ptr) (cte_map ptr')) proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do oldCTE <- getCTE (cte_map ptr');
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (4 subgoals):
 1. \<And>oldCTE. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (?Q'8 oldCTE) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od)
 2. \<lbrace>invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')\<rbrace> getCTE (cte_map ptr') \<lbrace>?Q'8\<rbrace>
 3. \<And>s. (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) s \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map ptr') \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. True \<Longrightarrow> no_fail (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) (getCTE (cte_map ptr')) proof (prove)
goal (4 subgoals):
 1. \<lbrace>invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')\<rbrace> getCTE (cte_map ptr') \<lbrace>?Q'8\<rbrace>
 2. \<And>s. (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) s \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map ptr') \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. True \<Longrightarrow> no_fail (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) (getCTE (cte_map ptr'))
 4. \<And>oldCTE. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (?Q'8 oldCTE) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (3 subgoals):
 1. \<And>s. (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) s \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map ptr') \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. True \<Longrightarrow> no_fail (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) (getCTE (cte_map ptr'))
 3. \<And>oldCTE. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. True \<Longrightarrow> no_fail (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) (getCTE (cte_map ptr'))
 2. \<And>oldCTE. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>True; (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map ptr') s
 2. \<And>oldCTE. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE. corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE. cteCap oldCTE = capability.NullCap \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od)
 2. \<And>oldCTE s. (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) s \<Longrightarrow> cteCap oldCTE = capability.NullCap proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE s. (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) s \<Longrightarrow> cteCap oldCTE = capability.NullCap
 2. \<And>oldCTE. cteCap oldCTE = capability.NullCap \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE. cteCap oldCTE = capability.NullCap \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od)
 2. \<And>oldCTE s. \<lbrakk>cteCap oldCTE = capability.NullCap; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) s\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE s. \<lbrakk>cteCap oldCTE = capability.NullCap; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) s\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE s. \<lbrakk>cteCap oldCTE = capability.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') s; invs' s; cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr') s\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE s. \<lbrakk>cteCap oldCTE = capability.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') s; cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr') s; valid_mdb' s\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE s cte. \<lbrakk>cteCap oldCTE = capability.NullCap; ctes_of s (cte_map ptr') = Some oldCTE; valid_dlist (ctes_of s); ctes_of s (cte_map ptr) = Some cte; no_0 (ctes_of s); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE s cte x1 x2. \<lbrakk>cteCap oldCTE = capability.NullCap; ctes_of s (cte_map ptr') = Some oldCTE; valid_dlist (ctes_of s); ctes_of s (cte_map ptr) = Some cte; no_0 (ctes_of s); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldCTE = CTE x1 x2\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>s cte x2. \<lbrakk>ctes_of s (cte_map ptr') = Some (CTE capability.NullCap x2); valid_dlist (ctes_of s); ctes_of s (cte_map ptr) = Some cte; no_0 (ctes_of s); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbPrev x2 = nullPointer \<and> mdbNext x2 = nullPointer
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>s cte x2. \<lbrakk>ctes_of s (cte_map ptr') = Some (CTE capability.NullCap x2); valid_dlist (ctes_of s); ctes_of s (cte_map ptr) = Some cte; no_0 (ctes_of s); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s (?p79 s cte x2) = Some (CTE capability.NullCap (?n81 s cte x2)) \<longrightarrow> ?n81 s cte x2 = nullMDBNode\<rbrakk> \<Longrightarrow> mdbPrev x2 = nullPointer \<and> mdbNext x2 = nullPointer
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>s cte x2. \<lbrakk>ctes_of s (cte_map ptr') = Some (CTE capability.NullCap x2); valid_dlist (ctes_of s); ctes_of s (cte_map ptr) = Some cte; no_0 (ctes_of s); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); x2 = nullMDBNode\<rbrakk> \<Longrightarrow> mdbPrev x2 = nullPointer \<and> mdbNext x2 = nullPointer
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do cte <- getCTE (cte_map ptr);
y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (4 subgoals):
 1. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (?Q'86 oldCTE cte) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od)
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))\<rbrace> getCTE (cte_map ptr) \<lbrace>?Q'86 oldCTE\<rbrace>
 3. \<And>oldCTE s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map ptr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (getCTE (cte_map ptr)) proof (prove)
goal (4 subgoals):
 1. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))\<rbrace> getCTE (cte_map ptr) \<lbrace>?Q'86 oldCTE\<rbrace>
 2. \<And>oldCTE s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map ptr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (getCTE (cte_map ptr))
 4. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (?Q'86 oldCTE cte) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (3 subgoals):
 1. \<And>oldCTE s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map ptr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (getCTE (cte_map ptr))
 3. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) (getCTE (cte_map ptr))
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; True; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr'))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map ptr) s
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) (do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) (do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) (do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od)
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; True; (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map ptr') and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map ptr) s \<and> (cte_map ptr' \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map ptr') s) \<and> (cte_map ptr \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map ptr) s) \<and> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode cte)) s) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s))) s
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; invs' s; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea))
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; valid_mdb' s\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea))
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea))
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (3 subgoals):
 1. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea)
 2. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea)
 3. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (3 subgoals):
 1. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbPrev (cteMDBNode cte)) = Some ctea
 2. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea)
 3. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea)
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>oldCTE cte s. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; ctes_of s (cte_map ptr) = Some cte; ctes_of s (cte_map ptr') = Some oldCTE; weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>ctea. ctes_of s (mdbNext (cteMDBNode cte)) = Some ctea
 2. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE cte. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at (\<lambda>_. True) ptr and cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' and valid_cap cap and tcb_cap_valid cap ptr' and (\<lambda>y. ptr \<noteq> ptr')) s \<and> (cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) and (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') and (invs' and cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr')))) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map ptr') cap';
y <- updateCap (cte_map ptr) capability.NullCap;
y <- updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte);
y <- updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode);
y <- updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr'));
updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr'))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE cte a b ba s'' s''a s''b s''c s''d. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; cte_wp_at' (\<lambda>c. c = cte) (cte_map ptr) b; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map ptr') b; invs' b; cte_wp_at' (\<lambda>c. weak_derived' cap' (cteCap c) \<and> cteCap c \<noteq> capability.NullCap) (cte_map ptr) b; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map ptr') b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE cte a b ba s'' s''a s''b s''c s''d. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some cte; ctes_of b (cte_map ptr') = Some oldCTE; invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE cte a b ba s'' s''a s''b s''c s''d x1 x2. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some cte; ctes_of b (cte_map ptr') = Some oldCTE; invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; oldCTE = CTE x1 x2\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE cte a b ba s'' s''a s''b s''c s''d x old_dest_node. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some cte; ctes_of b (cte_map ptr') = Some oldCTE; invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; oldCTE = CTE x old_dest_node\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE cte a b ba s'' s''a s''b s''c s''d x old_dest_node x1 x2. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some cte; ctes_of b (cte_map ptr') = Some oldCTE; invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; oldCTE = CTE x old_dest_node; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>oldCTE cte a b ba s'' s''a s''b s''c s''d x old_dest_node src_cap src_node. \<lbrakk>cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some cte; ctes_of b (cte_map ptr') = Some oldCTE; invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. cteMDBNode cte) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev (cteMDBNode cte)) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode cte)) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' (cteCap cte); cteCap cte \<noteq> capability.NullCap; oldCTE = CTE x old_dest_node; cte = CTE src_cap src_node\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; \<exists>c. caps_of_state a ptr = Some c\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<exists>c. caps_of_state a ptr = Some c proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<exists>c. caps_of_state a ptr = Some c
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; \<exists>c. caps_of_state a ptr = Some c\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; \<exists>c. caps_of_state a ptr = Some c\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c\<rbrakk> \<Longrightarrow> cap_relation c src_cap proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c\<rbrakk> \<Longrightarrow> cap_relation c src_cap
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; cte_wp_at ((=) c) ptr a\<rbrakk> \<Longrightarrow> cap_relation c src_cap
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; cte_wp_at ((=) c) ptr a\<rbrakk> \<Longrightarrow> pspace_aligned' b
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; cte_wp_at ((=) c) ptr a\<rbrakk> \<Longrightarrow> pspace_distinct' b
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; cte_wp_at ((=) c) ptr a; \<exists>cte. ctes_of b (cte_map ptr) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> cap_relation c src_cap
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; cte_wp_at ((=) c) ptr a\<rbrakk> \<Longrightarrow> pspace_distinct' b
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; cte_wp_at ((=) c) ptr a; \<exists>cte. ctes_of b (cte_map ptr) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> cap_relation c src_cap
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; cte_wp_at ((=) c) ptr a; \<exists>cte. ctes_of b (cte_map ptr) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> cap_relation c src_cap
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (11 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr' a
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_aligned' b
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct' b
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b)
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState b) \<in> arch_state_relation
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr' a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_aligned' b
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct' b
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b)
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState b) \<in> arch_state_relation
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (9 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr' a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_aligned' b
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct' b
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b)
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState b) \<in> arch_state_relation
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (8 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr' a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_aligned' b
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct' b
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b)
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState b) \<in> arch_state_relation
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (7 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_aligned' b
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct' b
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState b) \<in> arch_state_relation
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> pspace_distinct' b
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState b) \<in> arch_state_relation
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState b) \<in> arch_state_relation
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState b) \<in> arch_state_relation
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cap_relation (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) cap'
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap (?c297 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c) ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap\<rbrakk> \<Longrightarrow> cte_map ptr' = cte_map ptr'
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap cap ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; \<exists>t. ((), t) \<in> fst (set_cap cap ptr' a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap ptr';
y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (21 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> ekheap t = ekheap a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cur_thread t = ksCurThread s''
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> idle_thread t = ksIdleThread s''
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> machine_state t = ksMachineState s''
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> work_units_completed t = ksWorkUnitsCompleted s''
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> domain_index t = ksDomScheduleIdx s''
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> domain_list t = ksDomSchedule s''
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cur_domain t = ksCurDomain s''
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> domain_time t = ksDomainTime s''
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (?x340 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t, ?t'340 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t) \<in> fst (updateCap (?p'340 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t) (?c'340 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t) s'')
A total of 21 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> valid_objs t
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct t
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (valid_objs and valid_cap cap and tcb_cap_valid cap ptr') a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; valid_objs t\<rbrakk> \<Longrightarrow> valid_objs t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned t
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct t
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; valid_objs t\<rbrakk> \<Longrightarrow> valid_objs t
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct t
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned t
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (11 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; pspace_aligned t\<rbrakk> \<Longrightarrow> pspace_aligned t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct t
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; pspace_aligned t\<rbrakk> \<Longrightarrow> pspace_aligned t
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (9 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct t
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (10 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; pspace_distinct t\<rbrakk> \<Longrightarrow> pspace_distinct t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 10. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (9 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; pspace_distinct t\<rbrakk> \<Longrightarrow> pspace_distinct t
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (8 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (9 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p'362 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t) a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; cte_wp_at (\<lambda>_. True) (?p'362 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t) t\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (9 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; cte_wp_at (\<lambda>_. True) (?p'362 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t) t\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr t
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p'362 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t) a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (8 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (7 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (7 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s'')\<rbrakk> \<Longrightarrow> pspace_aligned' s''
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s'')\<rbrakk> \<Longrightarrow> pspace_distinct' s''
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'')
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState s'') \<in> arch_state_relation
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> cte_map ptr = cte_map ptr
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; \<exists>ta. ((), ta) \<in> fst (set_cap cap.NullCap ptr t) \<and> pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''a) \<and> cdt ta = cdt t \<and> cdt_list ta = cdt_list t \<and> ekheap ta = ekheap t \<and> scheduler_action ta = scheduler_action t \<and> ready_queues ta = ready_queues t \<and> is_original_cap ta = is_original_cap t \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a) \<and> (arch_state ta, ksArchState s''a) \<in> arch_state_relation \<and> cur_thread ta = ksCurThread s''a \<and> idle_thread ta = ksIdleThread s''a \<and> machine_state ta = ksMachineState s''a \<and> work_units_completed ta = ksWorkUnitsCompleted s''a \<and> domain_index ta = ksDomScheduleIdx s''a \<and> domain_list ta = ksDomSchedule s''a \<and> cur_domain ta = ksCurDomain s''a \<and> domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap cap.NullCap ptr;
src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) t). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> mdb_move_abs ptr ptr' (cdt a) a proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> mdb_move_abs ptr ptr' (cdt a) a proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> mdb_move_abs ptr ptr' (cdt a) a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> valid_mdb a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> cte_wp_at ((=) cap.NullCap) ptr' a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> cdt a = cdt a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> ptr \<noteq> ptr'
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> cte_wp_at ((=) cap.NullCap) ptr' a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> cdt a = cdt a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> ptr \<noteq> ptr'
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> cdt a = cdt a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> ptr \<noteq> ptr'
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a\<rbrakk> \<Longrightarrow> ptr \<noteq> ptr'
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do src_p <- gets (\<lambda>s. cdt s ptr);
dest_p <- gets (\<lambda>s. cdt s ptr');
cdt <- gets cdt;
y <- set_cdt (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt ptr else cdt r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt ptr else cdt r);
y <- cap_move_ext ptr ptr' src_p dest_p;
is_original <- gets is_original_cap;
y <- set_original ptr' (is_original ptr);
set_original ptr False
od) ta). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (put (ta\<lparr>cdt_list := case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr), cdt := \<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r, is_original_cap := (is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)\<rparr>) (ta\<lparr>cdt_list := case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr), cdt := \<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r, is_original_cap := (is_original_cap a)(ptr' := is_original_cap a ptr)\<rparr>)). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); invs' b; ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''; pspace_aligned' s''a \<and> pspace_distinct' s''a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''; pspace_aligned' s''a \<and> pspace_distinct' s''a; no_0 (ctes_of b)\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''; pspace_aligned' s''a \<and> pspace_distinct' s''a\<rbrakk> \<Longrightarrow> no_0 (ctes_of b) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''; pspace_aligned' s''a \<and> pspace_distinct' s''a\<rbrakk> \<Longrightarrow> no_0 (ctes_of b)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''; pspace_aligned' s''a \<and> pspace_distinct' s''a; no_0 (ctes_of b)\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''; pspace_aligned' s''a \<and> pspace_distinct' s''a; no_0 (ctes_of b)\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''; pspace_aligned' s''a \<and> pspace_distinct' s''a; no_0 (ctes_of b); no_0 (ctes_of s'')\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; pspace_aligned' s'' \<and> pspace_distinct' s''; pspace_aligned' s''a \<and> pspace_distinct' s''a; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a)\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''b) \<in> fst (updateMDB (cte_map ptr') (\<lambda>y. src_node) s''a); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''c) \<in> fst (updateMDB (cte_map ptr) (\<lambda>y. nullMDBNode) s''b); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), s''d) \<in> fst (updateMDB (mdbPrev src_node) (mdbNext_update (\<lambda>_. cte_map ptr')) s''c); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); ((), ba) \<in> fst (updateMDB (mdbNext src_node) (mdbPrev_update (\<lambda>_. cte_map ptr')) s''d); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); ((), s''a) \<in> fst (updateCap (cte_map ptr) capability.NullCap s''); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); ((), s'') \<in> fst (updateCap (cte_map ptr') cap' b); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s'')\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s'')\<rbrakk> \<Longrightarrow> pspace_distinct' b \<and> pspace_aligned' b proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s'')\<rbrakk> \<Longrightarrow> pspace_distinct' b \<and> pspace_aligned' b
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; valid_objs' b; pspace_aligned' b; pspace_distinct' b; no_0_obj' b; valid_mdb' b; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')); gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' b \<longrightarrow> pspace_aligned' s''; pspace_distinct' b \<longrightarrow> pspace_distinct' s''\<rbrakk> \<Longrightarrow> pspace_distinct' b \<and> pspace_aligned' b
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState s''a) \<in> arch_state_relation; cur_thread ta = ksCurThread s''a; idle_thread ta = ksIdleThread s''a; machine_state ta = ksMachineState s''a; work_units_completed ta = ksWorkUnitsCompleted s''a; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (ctes_of s''); no_0 (ctes_of s''a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (ctes_of s''a) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (ctes_of s''b) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState s''b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted s''b; ksCurThread s''c = ksCurThread s''b; ksIdleThread s''c = ksIdleThread s''b; ksReadyQueues s''c = ksReadyQueues s''b; ksSchedulerAction s''c = ksSchedulerAction s''b; ksInterruptState s''c = ksInterruptState s''b; ksArchState s''c = ksArchState s''b; gsUserPages s''c = gsUserPages s''b; gsCNodes s''c = gsCNodes s''b; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (ctes_of s''c); ksDomScheduleIdx s''c = ksDomScheduleIdx s''b; ksDomSchedule s''c = ksDomSchedule s''b; ksCurDomain s''c = ksCurDomain s''b; ksDomainTime s''c = ksDomainTime s''b; ctes_of s''d = modify_map (ctes_of s''c) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState s''c; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted s''c; ksCurThread s''d = ksCurThread s''c; ksIdleThread s''d = ksIdleThread s''c; ksReadyQueues s''d = ksReadyQueues s''c; ksSchedulerAction s''d = ksSchedulerAction s''c; ksInterruptState s''d = ksInterruptState s''c; ksArchState s''d = ksArchState s''c; gsUserPages s''d = gsUserPages s''c; gsCNodes s''d = gsCNodes s''c; pspace_relations (ekheap ta) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (ctes_of s''d); ksDomScheduleIdx s''d = ksDomScheduleIdx s''c; ksDomSchedule s''d = ksDomSchedule s''c; ksCurDomain s''d = ksCurDomain s''c; ksDomainTime s''d = ksDomainTime s''c; ctes_of ba = modify_map (ctes_of s''d) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState s''d; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''d; ksCurThread ba = ksCurThread s''d; ksIdleThread ba = ksIdleThread s''d; ksReadyQueues ba = ksReadyQueues s''d; ksSchedulerAction ba = ksSchedulerAction s''d; ksInterruptState ba = ksInterruptState s''d; ksArchState ba = ksArchState s''d; gsUserPages ba = gsUserPages s''d; gsCNodes ba = gsCNodes s''d; pspace_relations (ekheap ta) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''d; ksDomSchedule ba = ksDomSchedule s''d; ksCurDomain ba = ksCurDomain s''d; ksDomainTime ba = ksDomainTime s''d; ctes_of s''a = modify_map (ctes_of s'') (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksArchState s''a = ksArchState s''; pspace_distinct' s'' \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap ta) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (ctes_of ba) \<and> (arch_state ta, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState ba) \<and> ksCurThread s''a = ksCurThread ba \<and> ksIdleThread s''a = ksIdleThread ba \<and> ksMachineState s''a = ksMachineState ba \<and> ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx ba \<and> ksDomSchedule s''a = ksDomSchedule ba \<and> ksCurDomain s''a = ksCurDomain ba \<and> ksDomainTime s''a = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node)); ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of s''c = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)); ksMachineState s''c = ksMachineState b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksCurThread s''c = ksCurThread b; ksIdleThread s''c = ksIdleThread b; ksReadyQueues s''c = ksReadyQueues b; ksSchedulerAction s''c = ksSchedulerAction b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ctes_of s''d = modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr'))); ksMachineState s''d = ksMachineState b; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksCurThread s''d = ksCurThread b; ksIdleThread s''d = ksIdleThread b; ksReadyQueues s''d = ksReadyQueues b; ksSchedulerAction s''d = ksSchedulerAction b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ctes_of ba = modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))); ksMachineState ba = ksMachineState b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap)); gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksMachineState s''c = ksMachineState b; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksCurThread s''c = ksCurThread b; ksIdleThread s''c = ksIdleThread b; ksReadyQueues s''c = ksReadyQueues b; ksSchedulerAction s''c = ksSchedulerAction b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksMachineState s''d = ksMachineState b; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksCurThread s''d = ksCurThread b; ksIdleThread s''d = ksIdleThread b; ksReadyQueues s''d = ksReadyQueues b; ksSchedulerAction s''d = ksSchedulerAction b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksMachineState ba = ksMachineState b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksCurThread s''c = ksCurThread b; ksIdleThread s''c = ksIdleThread b; ksReadyQueues s''c = ksReadyQueues b; ksSchedulerAction s''c = ksSchedulerAction b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksCurThread s''d = ksCurThread b; ksIdleThread s''d = ksIdleThread b; ksReadyQueues s''d = ksReadyQueues b; ksSchedulerAction s''d = ksSchedulerAction b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksIdleThread s''c = ksIdleThread b; ksReadyQueues s''c = ksReadyQueues b; ksSchedulerAction s''c = ksSchedulerAction b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksIdleThread s''d = ksIdleThread b; ksReadyQueues s''d = ksReadyQueues b; ksSchedulerAction s''d = ksSchedulerAction b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksReadyQueues s''c = ksReadyQueues b; ksSchedulerAction s''c = ksSchedulerAction b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksReadyQueues s''d = ksReadyQueues b; ksSchedulerAction s''d = ksSchedulerAction b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksSchedulerAction s''c = ksSchedulerAction b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksSchedulerAction s''d = ksSchedulerAction b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksSchedulerAction s''a = ksSchedulerAction b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b\<rbrakk> \<Longrightarrow> \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''_; domain_list t_ = ksDomSchedule s''_; cur_domain t_ = ksCurDomain s''_; domain_time t_ = ksDomainTime s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); pspace_relations (ekheap a_) (kheap ta_) (ksPSpace s''a_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; scheduler_action ta_ = scheduler_action a_; ready_queues ta_ = ready_queues a_; is_original_cap ta_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node ta_) (interrupt_states ta_) (ksInterruptState s''a_); (arch_state ta_, ksArchState b_) \<in> arch_state_relation; cur_thread ta_ = ksCurThread b_; idle_thread ta_ = ksIdleThread b_; machine_state ta_ = ksMachineState b_; work_units_completed ta_ = ksWorkUnitsCompleted b_; domain_index ta_ = ksDomScheduleIdx s''a_; domain_list ta_ = ksDomSchedule s''a_; cur_domain ta_ = ksCurDomain s''a_; domain_time ta_ = ksDomainTime s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); no_0 (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksInterruptState s''b_ = ksInterruptState s''a_; ksArchState s''b_ = ksArchState b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap ta_) (ksPSpace s''b_); pspace_aligned' s''b_; pspace_distinct' s''b_; no_0 (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))); ksDomScheduleIdx s''b_ = ksDomScheduleIdx s''a_; ksDomSchedule s''b_ = ksDomSchedule s''a_; ksCurDomain s''b_ = ksCurDomain s''a_; ksDomainTime s''b_ = ksDomainTime s''a_; ksWorkUnitsCompleted s''c_ = ksWorkUnitsCompleted b_; ksInterruptState s''c_ = ksInterruptState s''a_; ksArchState s''c_ = ksArchState b_; gsUserPages s''c_ = gsUserPages b_; gsCNodes s''c_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap ta_) (ksPSpace s''c_); pspace_aligned' s''c_; pspace_distinct' s''c_; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c_ = ksDomScheduleIdx s''a_; ksDomSchedule s''c_ = ksDomSchedule s''a_; ksCurDomain s''c_ = ksCurDomain s''a_; ksDomainTime s''c_ = ksDomainTime s''a_; ksWorkUnitsCompleted s''d_ = ksWorkUnitsCompleted b_; ksInterruptState s''d_ = ksInterruptState s''a_; ksArchState s''d_ = ksArchState b_; gsUserPages s''d_ = gsUserPages b_; gsCNodes s''d_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap ta_) (ksPSpace s''d_); pspace_aligned' s''d_; pspace_distinct' s''d_; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d_ = ksDomScheduleIdx s''a_; ksDomSchedule s''d_ = ksDomSchedule s''a_; ksCurDomain s''d_ = ksCurDomain s''a_; ksDomainTime s''d_ = ksDomainTime s''a_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksInterruptState ba_ = ksInterruptState s''a_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap ta_) (ksPSpace ba_); pspace_aligned' ba_; pspace_distinct' ba_; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node_) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba_ = ksDomScheduleIdx s''a_; ksDomSchedule ba_ = ksDomSchedule s''a_; ksCurDomain ba_ = ksCurDomain s''a_; ksDomainTime ba_ = ksDomainTime s''a_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksArchState s''a_ = ksArchState b_; True \<longrightarrow> pspace_distinct' s''a_; pspace_aligned' s''a_; ctes_of s''_ = modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s''_ = gsUserPages b_ \<and> gsCNodes s''_ = gsCNodes b_ \<and> ksMachineState s''_ = ksMachineState b_ \<and> ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_ \<and> ksCurThread s''_ = ksCurThread b_ \<and> ksIdleThread s''_ = ksIdleThread b_ \<and> ksReadyQueues s''_ = ksReadyQueues b_ \<and> ksSchedulerAction s''_ = ksSchedulerAction b_ \<and> ksArchState s''_ = ksArchState b_ \<and> (True \<longrightarrow> pspace_aligned' s''_) \<and> (True \<longrightarrow> pspace_distinct' s''_); pspace_distinct' b_ \<and> pspace_aligned' b_\<rbrakk> \<Longrightarrow> \<forall>p. cte_wp_at (\<lambda>_. True) p ta_ = cte_wp_at (\<lambda>_. True) p a_ proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); no_0 (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))); no_0 (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))); True; True; True; True; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; no_0 (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))); ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))); ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; True \<longrightarrow> pspace_distinct' s''a; pspace_aligned' s''a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (True \<longrightarrow> pspace_aligned' s'') \<and> (True \<longrightarrow> pspace_distinct' s''); pspace_distinct' b \<and> pspace_aligned' b; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> True \<and> True \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) ta)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (K cap'))) (cte_map ptr) (cteCap_update (K capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> True \<and> True \<and> ksCurThread b = ksCurThread b \<and> ksIdleThread b = ksIdleThread b \<and> ksMachineState b = ksMachineState b \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted b \<and> ksDomScheduleIdx s''a = ksDomScheduleIdx s''a \<and> ksDomSchedule s''a = ksDomSchedule s''a \<and> ksCurDomain s''a = ksCurDomain s''a \<and> ksDomainTime s''a = ksDomainTime s''a proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr' a proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ptr' a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> cte_map ptr \<noteq> cte_map ptr' proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> cte_map ptr \<noteq> cte_map ptr'
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); pspace_relations (ekheap a) (kheap ta) (ksPSpace s''a); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''c); pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace s''d); pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap ta) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>p. cte_wp_at (\<lambda>_. True) p ta = cte_wp_at (\<lambda>_. True) p a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> pspace_relation (kheap ta) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap ta) (gsUserPages b) (gsCNodes b)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; gsCNodes s''c = gsCNodes b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; gsCNodes s''d = gsCNodes b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksWorkUnitsCompleted s''c = ksWorkUnitsCompleted b; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksWorkUnitsCompleted s''d = ksWorkUnitsCompleted b; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; cur_thread ta = ksCurThread b; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_index ta = ksDomScheduleIdx s''a; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; domain_time ta = ksDomainTime s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); cur_domain a = ksCurDomain b; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_list ta = ksDomSchedule s''a; cur_domain ta = ksCurDomain s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; scheduler_action ta = scheduler_action a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; ready_queues ta = ready_queues a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; idle_thread ta = ksIdleThread b; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; machine_state ta = ksMachineState b; work_units_completed ta = ksWorkUnitsCompleted b; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; work_units_completed ta = ksWorkUnitsCompleted b; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; ksArchState s''c = ksArchState b; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; ksArchState s''d = ksArchState b; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; ksArchState s''a = ksArchState b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; gsUserPages s''c = gsUserPages b; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; gsUserPages s''d = gsUserPages b; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; gsUserPages s''a = gsUserPages b; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; gsUserPages s'' = gsUserPages b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksCurDomain s''c = ksCurDomain s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksCurDomain s''d = ksCurDomain s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksCurDomain ba = ksCurDomain s''a; ksDomainTime ba = ksDomainTime s''a; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); ksInterruptState s''b = ksInterruptState s''a; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksDomainTime s''b = ksDomainTime s''a; ksInterruptState s''c = ksInterruptState s''a; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksDomainTime s''c = ksDomainTime s''a; ksInterruptState s''d = ksInterruptState s''a; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksDomainTime s''d = ksDomainTime s''a; ksInterruptState ba = ksInterruptState s''a; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksDomainTime ba = ksDomainTime s''a; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksDomainTime s''b = ksDomainTime s''a; pspace_aligned' s''c; pspace_distinct' s''c; ksDomScheduleIdx s''c = ksDomScheduleIdx s''a; ksDomSchedule s''c = ksDomSchedule s''a; ksDomainTime s''c = ksDomainTime s''a; pspace_aligned' s''d; pspace_distinct' s''d; ksDomScheduleIdx s''d = ksDomScheduleIdx s''a; ksDomSchedule s''d = ksDomSchedule s''a; ksDomainTime s''d = ksDomainTime s''a; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''a; ksDomSchedule ba = ksDomSchedule s''a; ksDomainTime ba = ksDomainTime s''a; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomSchedule s''b = ksDomSchedule s''a; ksDomainTime s''b = ksDomainTime s''a; pspace_aligned' s''c; pspace_distinct' s''c; ksDomSchedule s''c = ksDomSchedule s''a; ksDomainTime s''c = ksDomainTime s''a; pspace_aligned' s''d; pspace_distinct' s''d; ksDomSchedule s''d = ksDomSchedule s''a; ksDomainTime s''d = ksDomainTime s''a; pspace_aligned' ba; pspace_distinct' ba; ksDomSchedule ba = ksDomSchedule s''a; ksDomainTime ba = ksDomainTime s''a; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule b = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; ksDomSchedule s''b = ksDomSchedule s''a; pspace_aligned' s''c; pspace_distinct' s''c; ksDomSchedule s''c = ksDomSchedule s''a; pspace_aligned' s''d; pspace_distinct' s''d; ksDomSchedule s''d = ksDomSchedule s''a; pspace_aligned' ba; pspace_distinct' ba; ksDomSchedule ba = ksDomSchedule s''a; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; ctes_of s'' = modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap')); pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); ekheap_relation (ekheap a) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); ekheap_relation (ekheap a) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; pspace_relation (kheap ta) (ksPSpace s''a); pspace_relation (kheap ta) (ksPSpace s''b); pspace_relation (kheap ta) (ksPSpace s''c); pspace_relation (kheap ta) (ksPSpace s''d); pspace_relation (kheap ta) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; interrupt_state_relation (interrupt_irq_node ta) (interrupt_states ta) (ksInterruptState s''a); (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> (cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))))) \<and> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state t)(ptr \<mapsto> cap.NullCap)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter (caps_of_state ta)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap))) (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap))) ((ctes_of b)(cte_map ptr' \<mapsto> CTE capability.NullCap src_node, cte_map ptr \<mapsto> CTE src_cap nullMDBNode))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; ((ctes_of b)(cte_map ptr' \<mapsto> CTE capability.NullCap src_node, cte_map ptr \<mapsto> CTE src_cap nullMDBNode)) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> ((is_original_cap a)(ptr' := is_original_cap a ptr, ptr := False)) (aa, bb) = mdbRevocable node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr' \<longrightarrow> is_original_cap a ptr = mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) = ptr' \<longrightarrow> is_original_cap a ptr = mdbRevocable node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap c t ta aa bb y node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; a \<turnstile> cap; tcb_cap_valid cap (aa, bb) a; ptr \<noteq> (aa, bb); ctes_of b (cte_map ptr) = Some (CTE src_cap node); ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr (aa, bb) (cdt a) a; mdb_move_abs' ptr (aa, bb) (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map ptr \<noteq> cte_map (aa, bb); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); caps_of_state ta = (caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; ptr' = (aa, bb)\<rbrakk> \<Longrightarrow> is_original_cap a ptr = mdbRevocable node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap c t ta aa bb y node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; a \<turnstile> cap; tcb_cap_valid cap (aa, bb) a; ptr \<noteq> (aa, bb); ctes_of b (cte_map ptr) = Some (CTE src_cap node); ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr (aa, bb) (cdt a) a; mdb_move_abs' ptr (aa, bb) (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map ptr \<noteq> cte_map (aa, bb); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); caps_of_state ta = (caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; ptr' = (aa, bb); \<forall>ba. (\<exists>y. null_filter (caps_of_state a) (fst ptr, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (fst ptr, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (fst ptr, ba) = mdbRevocable node)\<rbrakk> \<Longrightarrow> is_original_cap a ptr = mdbRevocable node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap c t ta aa bb y node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; a \<turnstile> cap; tcb_cap_valid cap (aa, bb) a; ptr \<noteq> (aa, bb); ctes_of b (cte_map ptr) = Some (CTE src_cap node); ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr (aa, bb) (cdt a) a; mdb_move_abs' ptr (aa, bb) (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map ptr \<noteq> cte_map (aa, bb); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); caps_of_state ta = (caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; ptr' = (aa, bb); (\<exists>y. null_filter (caps_of_state a) (fst ptr, snd ptr) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (fst ptr, snd ptr)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (fst ptr, snd ptr) = mdbRevocable node)\<rbrakk> \<Longrightarrow> is_original_cap a ptr = mdbRevocable node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap c t ta aa bb y node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; a \<turnstile> cap; tcb_cap_valid cap (aa, bb) a; ptr \<noteq> (aa, bb); ctes_of b (cte_map ptr) = Some (CTE src_cap node); ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr (aa, bb) (cdt a) a; mdb_move_abs' ptr (aa, bb) (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map ptr \<noteq> cte_map (aa, bb); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); caps_of_state ta = (caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; ptr' = (aa, bb); (\<exists>y. null_filter (caps_of_state a) ptr = Some y) \<longrightarrow> is_original_cap a ptr = mdbRevocable node\<rbrakk> \<Longrightarrow> is_original_cap a ptr = mdbRevocable node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap c t ta aa bb y node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; a \<turnstile> cap; tcb_cap_valid cap (aa, bb) a; ptr \<noteq> (aa, bb); ctes_of b (cte_map ptr) = Some (CTE src_cap node); ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr (aa, bb) (cdt a) a; mdb_move_abs' ptr (aa, bb) (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map ptr \<noteq> cte_map (aa, bb); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); caps_of_state ta = (caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; ptr' = (aa, bb)\<rbrakk> \<Longrightarrow> \<exists>y. null_filter (caps_of_state a) ptr = Some y
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap c t ta aa bb y node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; a \<turnstile> cap; tcb_cap_valid cap (aa, bb) a; ptr \<noteq> (aa, bb); ctes_of b (cte_map ptr) = Some (CTE src_cap node); ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr (aa, bb) (cdt a) a; mdb_move_abs' ptr (aa, bb) (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map ptr \<noteq> cte_map (aa, bb); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); caps_of_state ta = (caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; ptr' = (aa, bb); is_original_cap a ptr = mdbRevocable node\<rbrakk> \<Longrightarrow> is_original_cap a ptr = mdbRevocable node
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) (aa_, bb_) a_; a_ \<turnstile> cap; tcb_cap_valid cap (aa_, bb_) a_; ptr \<noteq> (aa_, bb_); ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ node_); ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr (aa_, bb_) (cdt a_) a_; mdb_move_abs' ptr (aa_, bb_) (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; cte_map ptr \<noteq> cte_map (aa_, bb_); caps_of_state t_ = (caps_of_state a_)((aa_, bb_) \<mapsto> cap); caps_of_state ta_ = (caps_of_state a_)((aa_, bb_) \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a_)((aa_, bb_) \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa_, bb_) = Some y_; ptr' = (aa_, bb_)\<rbrakk> \<Longrightarrow> \<exists>y. null_filter (caps_of_state a_) ptr = Some y proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap c t ta aa bb y node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; a \<turnstile> cap; tcb_cap_valid cap (aa, bb) a; ptr \<noteq> (aa, bb); ctes_of b (cte_map ptr) = Some (CTE src_cap node); ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr (aa, bb) (cdt a) a; mdb_move_abs' ptr (aa, bb) (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map ptr \<noteq> cte_map (aa, bb); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); caps_of_state ta = (caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; ptr' = (aa, bb); is_original_cap a ptr = mdbRevocable node\<rbrakk> \<Longrightarrow> is_original_cap a ptr = mdbRevocable node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr' \<longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a) (aa, bb) \<noteq> None
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a) (aa, bb) \<noteq> None
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a_) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a_ (aa, ba) = mdbRevocable node); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t_ = (caps_of_state a_)(ptr' \<mapsto> cap); caps_of_state ta_ = (caps_of_state a_)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a_)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa_, bb_) = Some y_; (if cte_map (aa_, bb_) = cte_map ptr then Some (CTE src_cap_ nullMDBNode) else if cte_map (aa_, bb_) = cte_map ptr' then Some (CTE capability.NullCap src_node_) else ctes_of b_ (cte_map (aa_, bb_))) = Some (CTE capa_ node_); (aa_, bb_) \<noteq> ptr'\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a_) (aa_, bb_) \<noteq> None proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; cte_wp_at (\<lambda>c'. c' = ya \<and> c' \<noteq> cap.NullCap) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb y capa node ya. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map ptr then Some (CTE src_cap nullMDBNode) else if cte_map (aa, bb) = cte_map ptr' then Some (CTE capability.NullCap src_node) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); (aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable node) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable nullMDBNode) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> mdbRevocable src_node = mdbRevocable nullMDBNode)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable nullMDBNode) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> mdbRevocable src_node = mdbRevocable nullMDBNode)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable nullMDBNode) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> mdbRevocable src_node = mdbRevocable nullMDBNode)
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable nullMDBNode) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> mdbRevocable src_node = mdbRevocable nullMDBNode)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable nullMDBNode) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> mdbRevocable src_node = mdbRevocable nullMDBNode)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr\<rbrakk> \<Longrightarrow> ((aa, bb) = ptr \<longrightarrow> \<not> mdbRevocable nullMDBNode) \<and> ((aa, bb) \<noteq> ptr \<longrightarrow> mdbRevocable src_node = mdbRevocable nullMDBNode)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_node c t ta aa bb y capa ya. \<lbrakk>(aa, bb) \<noteq> ptr'; null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE capa src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' capa; capa \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c capa; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t = (caps_of_state a)(ptr' \<mapsto> cap); caps_of_state ta = (caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map ptr\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> ptr
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(aa_, bb_) \<noteq> ptr'; null_filter (caps_of_state a_) (aa_, bb_) = Some ya_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a_) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a_ (aa, ba) = mdbRevocable node); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE capa_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' capa_; capa_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ capa_; cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; caps_of_state t_ = (caps_of_state a_)(ptr' \<mapsto> cap); caps_of_state ta_ = (caps_of_state a_)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap); null_filter ((caps_of_state a_)(ptr' \<mapsto> cap, ptr \<mapsto> cap.NullCap)) (aa_, bb_) = Some y_; cte_map (aa_, bb_) = cte_map ptr\<rbrakk> \<Longrightarrow> (aa_, bb_) \<noteq> ptr proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of b) (cte_map ptr) src_cap src_node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_move_axioms (ctes_of b) (cte_map ptr) src_cap (cte_map ptr') cap' old_dest_node
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> vmdb (ctes_of b)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map ptr) src_cap src_node
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_move_axioms (ctes_of b) (cte_map ptr) src_cap (cte_map ptr') cap' old_dest_node
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> valid_mdb_ctes (ctes_of b)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map ptr) src_cap src_node
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_move_axioms (ctes_of b) (cte_map ptr) src_cap (cte_map ptr') cap' old_dest_node
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map ptr) src_cap src_node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_move_axioms (ctes_of b) (cte_map ptr) src_cap (cte_map ptr') cap' old_dest_node
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdb_move_axioms (ctes_of b) (cte_map ptr) src_cap (cte_map ptr') cap' old_dest_node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (7 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdbPrev old_dest_node = 0
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdbNext old_dest_node = 0
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> weak_derived' src_cap cap'
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> src_cap \<noteq> capability.NullCap
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ptr \<noteq> cte_map ptr'
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdbPrev old_dest_node = 0
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdbNext old_dest_node = 0
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> weak_derived' src_cap cap'
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> src_cap \<noteq> capability.NullCap
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ptr \<noteq> cte_map ptr'
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> mdbNext old_dest_node = 0
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> weak_derived' src_cap cap'
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> src_cap \<noteq> capability.NullCap
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ptr \<noteq> cte_map ptr'
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> weak_derived' src_cap cap'
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> src_cap \<noteq> capability.NullCap
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ptr \<noteq> cte_map ptr'
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> src_cap \<noteq> capability.NullCap
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ptr \<noteq> cte_map ptr'
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ptr \<noteq> cte_map ptr'
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) \<and> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = descendants_of' (cte_map (aa, ba)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdb_move_abs ptr ptr' (cdt a) (?s1395 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> valid_mdb (?s1395 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_wp_at ((=) cap.NullCap) ptr' (?s1395 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cdt a = cdt (?s1395 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> ptr \<noteq> ptr'
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_wp_at ((=) cap.NullCap) ptr' a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cdt a = cdt a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> ptr \<noteq> ptr'
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cdt a = cdt a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> ptr \<noteq> ptr'
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> ptr \<noteq> ptr'
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> cte_map (aa, bb) \<noteq> cte_map ptr
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> cte_map (aa, bb) \<noteq> cte_map ptr
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) = ptr'\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> cte_map (aa, bb) \<noteq> cte_map ptr'
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> cte_map (aa, bb) \<noteq> cte_map ptr'
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = ptr then {} else if (aa, bb) = ptr' then descendants_of ptr (cdt a) else descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = (if cte_map (aa, bb) = cte_map ptr then {} else if cte_map (aa, bb) = cte_map ptr' then descendants_of' (cte_map ptr) (ctes_of b) else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr} \<union> (if ptr \<in> descendants_of (aa, bb) (cdt a) then {ptr'} else {})) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr} \<union> (if cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) then {cte_map ptr'} else {})
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> (ptr \<in> descendants_of (aa, bb) (cdt a) \<longrightarrow> (cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = insert (cte_map ptr') (descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr})) \<and> (cte_map ptr \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = descendants_of' (cte_map (aa, bb)) (ctes_of b))) \<and> (ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> (cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr})) \<and> (cte_map ptr \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> (ptr \<in> descendants_of (aa, bb) (cdt a) \<longrightarrow> (cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = insert (cte_map ptr') (descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr})) \<and> (cte_map ptr \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = descendants_of' (cte_map (aa, bb)) (ctes_of b))) \<and> (ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> (cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr})) \<and> (cte_map ptr \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> (ptr \<in> descendants_of (aa, bb) (cdt a) \<longrightarrow> (cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = insert (cte_map ptr') (descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr})) \<and> (cte_map ptr \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = descendants_of' (cte_map (aa, bb)) (ctes_of b))) \<and> (ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> (cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr})) \<and> (cte_map ptr \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b)))
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; (aa_, bb_) \<noteq> ptr; cte_map (aa_, bb_) \<noteq> cte_map ptr; (aa_, bb_) \<noteq> ptr'; cte_map (aa_, bb_) \<noteq> cte_map ptr'\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (aa_, bb_)) (ctes_of b_) = cte_map ` descendants_of (aa_, bb_) (cdt a_) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> (ptr \<in> descendants_of (aa, bb) (cdt a) \<longrightarrow> (cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = insert (cte_map ptr') (descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr})) \<and> (cte_map ptr \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = descendants_of' (cte_map (aa, bb)) (ctes_of b))) \<and> (ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> (cte_map ptr \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map ptr})) \<and> (cte_map ptr \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> (ptr \<in> descendants_of (aa, bb) (cdt a) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})) \<and> (ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr}))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<in> descendants_of (aa, bb) (cdt a) \<longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` (descendants_of (aa, bb) (cdt a) - {ptr})) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> inj_on cte_map (?C1460 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> ?C1460 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {ptr} \<subseteq> ?C1460 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_mdb (?s1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs (?s1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct (?s1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned (?s1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb)
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt (?s1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb))
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {ptr} \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt (?s1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb))
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 9. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt a)
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {ptr} \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt a)
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 8. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (7 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt a)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {ptr} \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt a)
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 7. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt a)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {ptr} \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt a)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt a)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {ptr} \<subseteq> descendants_of (?p1462 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb) (cdt a)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {ptr} \<subseteq> descendants_of (aa, bb) (cdt a)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; (aa_, bb_) \<noteq> ptr; cte_map (aa_, bb_) \<noteq> cte_map ptr; (aa_, bb_) \<noteq> ptr'; cte_map (aa_, bb_) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa_, bb_)) (ctes_of b_) = cte_map ` descendants_of (aa_, bb_) (cdt a_); ptr \<in> descendants_of (aa_, bb_) (cdt a_)\<rbrakk> \<Longrightarrow> {ptr} \<subseteq> descendants_of (aa_, bb_) (cdt a_) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; (aa_, bb_) \<noteq> ptr; cte_map (aa_, bb_) \<noteq> cte_map ptr; (aa_, bb_) \<noteq> ptr'; cte_map (aa_, bb_) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa_, bb_)) (ctes_of b_) = cte_map ` descendants_of (aa_, bb_) (cdt a_); ptr \<in> descendants_of (aa_, bb_) (cdt a_)\<rbrakk> \<Longrightarrow> insert (cte_map ptr') (cte_map ` descendants_of (aa_, bb_) (cdt a_) - cte_map ` {ptr}) = insert (cte_map ptr') (cte_map ` descendants_of (aa_, bb_) (cdt a_) - {cte_map ptr}) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map ptr; (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> ptr \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ptr \<in> cte_map ` descendants_of (aa, bb) (cdt a) \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map ptr})
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); cte_map ptr = cte_map (ab, bc); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map (ab, bc)})
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ab, bc) a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); ptr = (ab, bc)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map (ab, bc)})
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_mdb a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); ptr = (ab, bc)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map (ab, bc)})
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); ptr = (ab, bc)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map (ab, bc)})
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); ptr = (ab, bc)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map (ab, bc)})
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); ptr = (ab, bc)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map (ab, bc)})
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb ab bc. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map (ab, bc)) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map (ab, bc) \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map (ab, bc)) src_cap src_node (cte_map ptr') cap' old_dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> ptr; cte_map (aa, bb) \<noteq> cte_map (ab, bc); (aa, bb) \<noteq> ptr'; cte_map (aa, bb) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); ptr \<notin> descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); ptr = (ab, bc)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = insert (cte_map ptr') (cte_map ` descendants_of (aa, bb) (cdt a) - {cte_map (ab, bc)})
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map (ab_, bc_)) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map (ab_, bc_) \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map (ab_, bc_)) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; (aa_, bb_) \<noteq> ptr; cte_map (aa_, bb_) \<noteq> cte_map (ab_, bc_); (aa_, bb_) \<noteq> ptr'; cte_map (aa_, bb_) \<noteq> cte_map ptr'; descendants_of' (cte_map (aa_, bb_)) (ctes_of b_) = cte_map ` descendants_of (aa_, bb_) (cdt a_); ptr \<notin> descendants_of (aa_, bb_) (cdt a_); (ab_, bc_) \<in> descendants_of (aa_, bb_) (cdt a_); ptr = (ab_, bc_)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa_, bb_) (cdt a_) = insert (cte_map ptr') (cte_map ` descendants_of (aa_, bb_) (cdt a_) - {cte_map (ab_, bc_)}) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr')))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) of None \<Rightarrow> next_slot (aa, bb) (?t'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node | Some q' \<Rightarrow> next_slot (aa, bb) (?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q') (?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q') = ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) of None \<Rightarrow> ?t'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) | Some q' \<Rightarrow> ?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b)\<rbrakk> \<Longrightarrow> (?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = None \<longrightarrow> next_slot (aa, bb) (?t'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) \<and> (\<forall>x2. ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = Some x2 \<longrightarrow> next_slot (aa, bb) (?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) (?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) = ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) of None \<Rightarrow> ?t'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) | Some q' \<Rightarrow> ?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = None\<rbrakk> \<Longrightarrow> next_slot (aa, bb) (?t'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b)\<rbrakk> \<Longrightarrow> \<forall>x2. ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = Some x2 \<longrightarrow> next_slot (aa, bb) (?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) (?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) = ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) of None \<Rightarrow> ?t'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m'1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) | Some q' \<Rightarrow> ?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case ?y1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (6 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = None\<rbrakk> \<Longrightarrow> mdb_move_abs' (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?s1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = None\<rbrakk> \<Longrightarrow> valid_list_2 (?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = None\<rbrakk> \<Longrightarrow> ?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = None
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b)\<rbrakk> \<Longrightarrow> \<forall>x2. ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = Some x2 \<longrightarrow> next_slot (aa, bb) (?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) (?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) = (if (aa, bb) = ?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node then None else if (aa, bb) = ?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node then next_slot (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) else if next_slot (aa, bb) (?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = Some (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) then Some (?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) else next_slot (aa, bb) (?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node))
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case ?n1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?q1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) of None \<Rightarrow> (?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node)(?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node := [], ?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node := ?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node)) = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> (\<lambda>r. if (if r = ?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node then None else ((?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node)(?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node := ?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node))) r) = Some (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) then Some (?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) else ((?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node)(?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node := ?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node), ?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) | Some q' \<Rightarrow> ?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r)
 6. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case if (aa, bb) = ?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node then None else if (aa, bb) = ?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node then next_slot (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) else if next_slot (aa, bb) (?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) = Some (?src1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) then Some (?dest1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) else next_slot (aa, bb) (?t1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) (?m1536 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b)\<rbrakk> \<Longrightarrow> \<forall>x2. cdt a ptr = Some x2 \<longrightarrow> next_slot (aa, bb) (?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) (?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) = (if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> (\<lambda>r. if (if r = ptr then None else ((cdt a)(ptr' := cdt a ptr)) r) = Some ptr then Some ptr' else ((cdt a)(ptr' := cdt a ptr, ptr := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) | Some q' \<Rightarrow> ?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt a ptr = Some x2\<rbrakk> \<Longrightarrow> next_slot (aa, bb) (?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) (?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2) = (if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> (\<lambda>r. if (if r = ptr then None else ((cdt a)(ptr' := cdt a ptr)) r) = Some ptr then Some ptr' else ((cdt a)(ptr' := cdt a ptr, ptr := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) | Some q' \<Rightarrow> ?t''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> ?m''1511 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r)
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (5 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt a ptr = Some x2\<rbrakk> \<Longrightarrow> mdb_move_abs' ptr ptr' (cdt a) (?s1544 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt a ptr = Some x2\<rbrakk> \<Longrightarrow> valid_list a
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); cdt a ptr = Some x2\<rbrakk> \<Longrightarrow> cdt a ptr = Some (?src_p1544 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node x2)
 4. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> (\<lambda>r. if (if r = ptr then None else ((cdt a)(ptr' := cdt a ptr)) r) = Some ptr then Some ptr' else ((cdt a)(ptr' := cdt a ptr, ptr := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) | Some q' \<Rightarrow> (cdt_list a)(?src_p1544 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q' := list_replace (cdt_list a (?src_p1544 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node q')) ptr ptr', ptr := [], ptr' := cdt_list a ptr) = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> (\<lambda>r. if (if r = ptr then None else ((cdt a)(ptr' := cdt a ptr)) r) = Some ptr then Some ptr' else ((cdt a)(ptr' := cdt a ptr, ptr := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r)
 5. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> (\<lambda>r. if (if r = ptr then None else ((cdt a)(ptr' := cdt a ptr)) r) = Some ptr then Some ptr' else ((cdt a)(ptr' := cdt a ptr, ptr := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) | Some q' \<Rightarrow> (cdt_list a)(q' := list_replace (cdt_list a q') ptr ptr', ptr := [], ptr' := cdt_list a ptr) = (case cdt a ptr of None \<Rightarrow> (cdt_list a)(ptr := [], ptr' := cdt_list a ptr) | Some p \<Rightarrow> (cdt_list a)(p := list_replace (cdt_list a p) ptr ptr', ptr := [], ptr' := cdt_list a ptr)) \<and> (\<lambda>r. if (if r = ptr then None else ((cdt a)(ptr' := cdt a ptr)) r) = Some ptr then Some ptr' else ((cdt a)(ptr' := cdt a ptr, ptr := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a ptr else cdt a r)
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node_) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa_, bb_)) = Some (CTE capa_ node_)\<rbrakk> \<Longrightarrow> case cdt a_ ptr of None \<Rightarrow> (cdt_list a_)(ptr := [], ptr' := cdt_list a_ ptr) = (case cdt a_ ptr of None \<Rightarrow> (cdt_list a_)(ptr := [], ptr' := cdt_list a_ ptr) | Some p \<Rightarrow> (cdt_list a_)(p := list_replace (cdt_list a_ p) ptr ptr', ptr := [], ptr' := cdt_list a_ ptr)) \<and> (\<lambda>r. if (if r = ptr then None else ((cdt a_)(ptr' := cdt a_ ptr)) r) = Some ptr then Some ptr' else ((cdt a_)(ptr' := cdt a_ ptr, ptr := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a_ ptr else cdt a_ r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a_ ptr else cdt a_ r) | Some q' \<Rightarrow> (cdt_list a_)(q' := list_replace (cdt_list a_ q') ptr ptr', ptr := [], ptr' := cdt_list a_ ptr) = (case cdt a_ ptr of None \<Rightarrow> (cdt_list a_)(ptr := [], ptr' := cdt_list a_ ptr) | Some p \<Rightarrow> (cdt_list a_)(p := list_replace (cdt_list a_ p) ptr ptr', ptr := [], ptr' := cdt_list a_ ptr)) \<and> (\<lambda>r. if (if r = ptr then None else ((cdt a_)(ptr' := cdt a_ ptr)) r) = Some ptr then Some ptr' else ((cdt a_)(ptr' := cdt a_ ptr, ptr := None)) r) = (\<lambda>r. if (if r = ptr then None else if r = ptr' then cdt a_ ptr else cdt a_ r) = Some ptr then Some ptr' else if r = ptr then None else if r = ptr' then cdt a_ ptr else cdt a_ r) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = None\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node_) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa_, bb_)) = Some (CTE capa_ node_); ctes_of b_ (cte_map (aa_, bb_)) = None\<rbrakk> \<Longrightarrow> case if (aa_, bb_) = ptr then None else if (aa_, bb_) = ptr' then next_slot ptr (cdt_list a_) (cdt a_) else if next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some ptr then Some ptr' else next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node_ = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2\<rbrakk> \<Longrightarrow> modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>_. cap'))) (cte_map ptr) (cteCap_update (\<lambda>_. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>m. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>m. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (?p1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2) = Some (CTE (?cte'1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2) (?node'1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2\<rbrakk> \<Longrightarrow> ctes_of b (?p1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2) = Some (CTE (?cte1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2) (?node1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2))
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext (?node'1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2) = (if ?p1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 = cte_map ptr then 0 else if ?p1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 = cte_map ptr' then mdbNext src_node else if mdbNext (?node1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2) = cte_map ptr then cte_map ptr' else mdbNext (?node1553 a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2))\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2)\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) = ptr\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) = ptr'\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) = ptr'; next_slot ptr (cdt_list a) (cdt a) = None\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 ac. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) = ptr'; next_slot ptr (cdt_list a) (cdt a) = Some ac\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node_) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa_, bb_)) = Some (CTE capa_ node_); ctes_of b_ (cte_map (aa_, bb_)) = Some ab_; ab_ = CTE x1_ x2_; mdbNext node_ = (if cte_map (aa_, bb_) = cte_map ptr then 0 else if cte_map (aa_, bb_) = cte_map ptr' then mdbNext src_node_ else if mdbNext x2_ = cte_map ptr then cte_map ptr' else mdbNext x2_); (aa_, bb_) \<noteq> ptr; (aa_, bb_) = ptr'; next_slot ptr (cdt_list a_) (cdt a_) = None\<rbrakk> \<Longrightarrow> case if (aa_, bb_) = ptr then None else if (aa_, bb_) = ptr' then next_slot ptr (cdt_list a_) (cdt a_) else if next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some ptr then Some ptr' else next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node_ = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 ac. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) = ptr'; next_slot ptr (cdt_list a) (cdt a) = Some ac\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 ac x2. \<lbrakk>old_dest_node = x2; mdbPrev x2 = nullPointer; mdbNext x2 = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap x2); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' x2; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map ptr') = Some (CTE capa node); capability.NullCap = x1; ab = CTE capability.NullCap x2; mdbNext node = mdbNext src_node; (aa, bb) = ptr'; next_slot ptr (cdt_list a) (cdt a) = Some ac\<rbrakk> \<Longrightarrow> mdbNext src_node = cte_map ac
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 ac x2. \<lbrakk>old_dest_node = x2; mdbPrev x2 = nullPointer; mdbNext x2 = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap x2); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' x2; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map ptr') = Some (CTE capa node); capability.NullCap = x1; ab = CTE capability.NullCap x2; mdbNext node = mdbNext src_node; (aa, bb) = ptr'; next_slot ptr (cdt_list a) (cdt a) = Some ac; \<forall>ba cap node. ctes_of b (cte_map (fst ptr, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (fst ptr, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext src_node = cte_map ac
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 ac x2. \<lbrakk>old_dest_node = x2; mdbPrev x2 = nullPointer; mdbNext x2 = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap x2); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' x2; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map ptr') = Some (CTE capa node); capability.NullCap = x1; ab = CTE capability.NullCap x2; mdbNext node = mdbNext src_node; (aa, bb) = ptr'; next_slot ptr (cdt_list a) (cdt a) = Some ac; \<forall>cap node. ctes_of b (cte_map (fst ptr, snd ptr)) = Some (CTE cap node) \<longrightarrow> (case next_slot (fst ptr, snd ptr) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext src_node = cte_map ac
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<lbrakk>old_dest_node_ = x2_; mdbPrev x2_ = nullPointer; mdbNext x2_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap x2_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' x2_; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node_) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map ptr') = Some (CTE capa_ node_); capability.NullCap = x1_; ab_ = CTE capability.NullCap x2_; mdbNext node_ = mdbNext src_node_; (aa_, bb_) = ptr'; next_slot ptr (cdt_list a_) (cdt a_) = Some ac_; \<forall>cap node. ctes_of b_ (cte_map (fst ptr, snd ptr)) = Some (CTE cap node) \<longrightarrow> (case next_slot (fst ptr, snd ptr) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext src_node_ = cte_map ac_ proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some ab; ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a)\<rbrakk> \<Longrightarrow> case if (aa, bb) = ptr then None else if (aa, bb) = ptr' then next_slot ptr (cdt_list a) (cdt a) else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr then Some ptr' else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a)\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext x2 = cte_map ptr'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext x2 = cte_map ptr')))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext x2 = cte_map ptr'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext x2 = cte_map ptr')))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext x2 = cte_map ptr'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr; cte_wp_at (\<lambda>_. True) (aa, bb) a; \<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext x2 = cte_map ptr')))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext x2 = cte_map ptr'))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node_) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa_, bb_)) = Some (CTE capa_ node_); ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE x1_ x2_); ab_ = CTE x1_ x2_; mdbNext node_ = (if cte_map (aa_, bb_) = cte_map ptr then 0 else if cte_map (aa_, bb_) = cte_map ptr' then mdbNext src_node_ else if mdbNext x2_ = cte_map ptr then cte_map ptr' else mdbNext x2_); (aa_, bb_) \<noteq> ptr; (aa_, bb_) \<noteq> ptr'; valid_mdb a_; valid_pspace a_; finite_depth (cdt a_); next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some ptr; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; \<forall>cap node. ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> (mdbNext x2_ = cte_map ptr \<longrightarrow> (cte_map (aa_, bb_) = cte_map ptr' \<longrightarrow> (next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some ptr \<longrightarrow> mdbNext src_node_ = cte_map ptr') \<and> (next_slot (aa_, bb_) (cdt_list a_) (cdt a_) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node_ = cte_map next))) \<and> (cte_map (aa_, bb_) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa_, bb_) = cte_map ptr \<longrightarrow> (next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa_, bb_) (cdt_list a_) (cdt a_) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa_, bb_) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa_, bb_) (cdt_list a_) (cdt a_) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2_ \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa_, bb_) = cte_map ptr' \<longrightarrow> (next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some ptr \<longrightarrow> mdbNext src_node_ = cte_map ptr') \<and> (next_slot (aa_, bb_) (cdt_list a_) (cdt a_) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node_ = cte_map next))) \<and> (cte_map (aa_, bb_) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa_, bb_) = cte_map ptr \<longrightarrow> (next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa_, bb_) (cdt_list a_) (cdt a_) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa_, bb_) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some ptr \<longrightarrow> mdbNext x2_ = cte_map ptr'))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext src_node = cte_map ptr') \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> cte_map ptr' = 0) \<and> (next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> next_slot (aa, bb) (cdt_list a) (cdt a) = Some ptr \<longrightarrow> mdbNext x2 = cte_map ptr'))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr; next_slot (aa, bb) (cdt_list a) (cdt a) = None\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)))
 2. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 ac. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev old_dest_node_ = nullPointer; mdbNext old_dest_node_ = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at (\<lambda>_. True) ptr a_; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a_; a_ \<turnstile> cap; tcb_cap_valid cap ptr' a_; ptr \<noteq> ptr'; ctes_of b_ (cte_map ptr) = Some (CTE src_cap_ src_node_); ctes_of b_ (cte_map ptr') = Some (CTE capability.NullCap old_dest_node_); weak_derived' cap' src_cap_; src_cap_ \<noteq> capability.NullCap; caps_of_state a_ ptr = Some c_; cap_relation c_ src_cap_; ((), t_) \<in> fst (set_cap cap ptr' a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; ((), ta_) \<in> fst (set_cap cap.NullCap ptr t_); cdt ta_ = cdt a_; cdt_list ta_ = cdt_list a_; ekheap ta_ = ekheap a_; is_original_cap ta_ = is_original_cap a_; (arch_state ta_, ksArchState b_) \<in> arch_state_relation; domain_list ta_ = ksDomSchedule s''a_; mdb_move_abs ptr ptr' (cdt a_) a_; mdb_move_abs' ptr ptr' (cdt a_) a_; valid_pspace' b_; sch_act_wf (ksSchedulerAction b_) b_; Invariants_H.valid_queues b_; sym_refs (state_refs_of' b_); if_live_then_nonz_cap' b_; if_unsafe_then_cap' b_; valid_idle' b_; valid_global_refs' b_; valid_arch_state' b_; valid_irq_node' (irq_node' b_) b_; valid_irq_handlers' b_; valid_irq_states' b_; valid_machine_state' b_; irqs_masked' b_; valid_queues' b_; ct_not_inQ b_; ct_idle_or_in_cur_domain' b_; valid_pde_mappings' b_; pspace_domain_valid b_; ksCurDomain b_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b_; cur_tcb' b_; no_0 (ctes_of b_); pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' s''c_; pspace_distinct' s''c_; pspace_aligned' s''d_; pspace_distinct' s''d_; pspace_aligned' ba_; pspace_distinct' ba_; pspace_distinct' s''a_; pspace_aligned' s''a_; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta_ = cte_wp_at (\<lambda>_. True) (aa, b) a_; pspace_distinct' b_; pspace_aligned' b_; pspace_aligned' s''_; pspace_distinct' s''_; cte_wp_at (\<lambda>_. True) ptr' a_; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b_) (cte_map ptr) src_cap_ src_node_ (cte_map ptr') cap' old_dest_node_; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b_) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node_))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node_) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa_, bb_)) = Some (CTE capa_ node_); ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE x1_ x2_); ab_ = CTE x1_ x2_; mdbNext node_ = (if cte_map (aa_, bb_) = cte_map ptr then 0 else if cte_map (aa_, bb_) = cte_map ptr' then mdbNext src_node_ else if mdbNext x2_ = cte_map ptr then cte_map ptr' else mdbNext x2_); (aa_, bb_) \<noteq> ptr; (aa_, bb_) \<noteq> ptr'; valid_mdb a_; valid_pspace a_; finite_depth (cdt a_); next_slot (aa_, bb_) (cdt_list a_) (cdt a_) \<noteq> Some ptr; next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = None\<rbrakk> \<Longrightarrow> (mdbNext x2_ = cte_map ptr \<longrightarrow> (cte_map (aa_, bb_) = cte_map ptr' \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node_ = cte_map next)) \<and> (cte_map (aa_, bb_) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa_, bb_) = cte_map ptr \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)) \<and> (cte_map (aa_, bb_) \<noteq> cte_map ptr \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2_ \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa_, bb_) = cte_map ptr' \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node_ = cte_map next)) \<and> (cte_map (aa_, bb_) \<noteq> cte_map ptr' \<longrightarrow> cte_map (aa_, bb_) = cte_map ptr \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 ac. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 ac. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 ac. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (\<lambda>_. True) ac a\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba s'' s''a s''b s''c s''d old_dest_node src_cap src_node c t ta aa bb capa node ab x1 x2 ac. \<lbrakk>mdbPrev old_dest_node = nullPointer; mdbNext old_dest_node = nullPointer; cdt_relation (\<lambda>y. cte_wp_at (\<lambda>_. True) y a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule (KernelInit_H.newKernelState undefined); invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at (\<lambda>_. True) ptr a; cte_wp_at (\<lambda>c. c = cap.NullCap) ptr' a; a \<turnstile> cap; tcb_cap_valid cap ptr' a; ptr \<noteq> ptr'; ctes_of b (cte_map ptr) = Some (CTE src_cap src_node); ctes_of b (cte_map ptr') = Some (CTE capability.NullCap old_dest_node); weak_derived' cap' src_cap; src_cap \<noteq> capability.NullCap; caps_of_state a ptr = Some c; cap_relation c src_cap; ((), t) \<in> fst (set_cap cap ptr' a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; ((), ta) \<in> fst (set_cap cap.NullCap ptr t); cdt ta = cdt a; cdt_list ta = cdt_list a; ekheap ta = ekheap a; is_original_cap ta = is_original_cap a; (arch_state ta, ksArchState b) \<in> arch_state_relation; domain_list ta = ksDomSchedule s''a; mdb_move_abs ptr ptr' (cdt a) a; mdb_move_abs' ptr ptr' (cdt a) a; valid_pspace' b; sch_act_wf (ksSchedulerAction b) b; Invariants_H.valid_queues b; sym_refs (state_refs_of' b); if_live_then_nonz_cap' b; if_unsafe_then_cap' b; valid_idle' b; valid_global_refs' b; valid_arch_state' b; valid_irq_node' (irq_node' b) b; valid_irq_handlers' b; valid_irq_states' b; valid_machine_state' b; irqs_masked' b; valid_queues' b; ct_not_inQ b; ct_idle_or_in_cur_domain' b; valid_pde_mappings' b; pspace_domain_valid b; ksCurDomain b \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomScheduleIdx b < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' b; cur_tcb' b; no_0 (ctes_of b); pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' s''c; pspace_distinct' s''c; pspace_aligned' s''d; pspace_distinct' s''d; pspace_aligned' ba; pspace_distinct' ba; pspace_distinct' s''a; pspace_aligned' s''a; \<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) ta = cte_wp_at (\<lambda>_. True) (aa, b) a; pspace_distinct' b; pspace_aligned' b; pspace_aligned' s''; pspace_distinct' s''; cte_wp_at (\<lambda>_. True) ptr' a; cte_map ptr \<noteq> cte_map ptr'; mdb_move (ctes_of b) (cte_map ptr) src_cap src_node (cte_map ptr') cap' old_dest_node; modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map ptr') (cteCap_update (\<lambda>y. cap'))) (cte_map ptr) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ptr') (cteMDBNode_update (\<lambda>y. src_node))) (cte_map ptr) (cteMDBNode_update (\<lambda>y. nullMDBNode))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map ptr')))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map ptr'))) (cte_map (aa, bb)) = Some (CTE capa node); ctes_of b (cte_map (aa, bb)) = Some (CTE x1 x2); ab = CTE x1 x2; mdbNext node = (if cte_map (aa, bb) = cte_map ptr then 0 else if cte_map (aa, bb) = cte_map ptr' then mdbNext src_node else if mdbNext x2 = cte_map ptr then cte_map ptr' else mdbNext x2); (aa, bb) \<noteq> ptr; (aa, bb) \<noteq> ptr'; valid_mdb a; valid_pspace a; finite_depth (cdt a); next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some ptr; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (\<lambda>_. True) ac a; \<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> (mdbNext x2 = cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> (cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map ptr' = cte_map next)))) \<and> (mdbNext x2 \<noteq> cte_map ptr \<longrightarrow> (cte_map (aa, bb) = cte_map ptr' \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext src_node = cte_map next)) \<and> (cte_map (aa, bb) \<noteq> cte_map ptr' \<longrightarrow> cte_map (aa, bb) = cte_map ptr \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0)))