theory CSpace_R

lemma create_reply_master_corres:
  "\<lbrakk> sl' = cte_map sl ; AllowGrant \<in> rights \<rbrakk> \<Longrightarrow>
   corres dc
      (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list)
      (cte_wp_at' (\<lambda>c. cteCap c = NullCap \<and> mdbPrev (cteMDBNode c) = 0) sl'
       and valid_mdb' and valid_pspace')
      (do
         y \<leftarrow> set_original sl True;
         set_cap (cap.ReplyCap thread True rights) sl
       od)
      (setCTE sl' (CTE (capability.ReplyCap thread True True) initMDBNode))" apply clarsimp apply (rule corres_caps_decomposition) defer apply (wp|simp)+ apply (clarsimp simp: o_def cdt_relation_def cte_wp_at_ctes_of
                     split del: if_split cong: if_cong simp del: id_apply) apply (case_tac cte, clarsimp) apply (fold fun_upd_def) apply (subst descendants_of_Null_update') apply fastforce apply fastforce apply assumption apply assumption apply (simp add: nullPointer_def) apply (subgoal_tac "cte_at (a, b) s") prefer 2 apply (drule not_sym, clarsimp simp: cte_wp_at_caps_of_state
                                         split: if_split_asm) apply (simp add: state_relation_def cdt_relation_def) apply (clarsimp simp: o_def cdt_list_relation_def cte_wp_at_ctes_of
                    split del: if_split cong: if_cong simp del: id_apply) apply (case_tac cte, clarsimp) apply (clarsimp simp: state_relation_def cdt_list_relation_def) apply (simp split: if_split_asm) apply (erule_tac x=a in allE, erule_tac x=b in allE) apply clarsimp apply(case_tac "next_slot (a, b) (cdt_list s) (cdt s)") apply(simp) apply(simp) apply(fastforce simp: valid_mdb'_def valid_mdb_ctes_def valid_nullcaps_def) apply (clarsimp simp: state_relation_def) apply (clarsimp simp: state_relation_def) apply (clarsimp simp add: revokable_relation_def cte_wp_at_ctes_of
                     split del: if_split) apply simp apply (rule conjI) apply (clarsimp simp: initMDBNode_def) apply clarsimp apply (subgoal_tac "null_filter (caps_of_state s) (a, b) \<noteq> None") prefer 2 apply (clarsimp simp: null_filter_def cte_wp_at_caps_of_state
                      split: if_split_asm) apply (subgoal_tac "cte_at (a,b) s") prefer 2 apply clarsimp apply (drule null_filter_caps_of_stateD) apply (erule cte_wp_cte_at) apply (clarsimp split: if_split_asm cong: conj_cong
                       simp: cte_map_eq_subst revokable_relation_simp
                             cte_wp_at_cte_at valid_pspace_def) apply (clarsimp simp: state_relation_def) apply (clarsimp elim!: state_relationE simp: ghost_relation_of_heap)+ apply (rule corres_guard_imp) apply (rule corres_underlying_symb_exec_l [OF set_original_symb_exec_l']) apply (rule setCTE_corres) apply simp apply wp apply (clarsimp simp: cte_wp_at_cte_at valid_pspace_def) apply (clarsimp simp: valid_pspace'_def cte_wp_at'_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) sl' and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE sl' (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (43 subgoals):
 1. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode))
 2. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_caps1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (caps_of_state s)\<rbrace>
 3. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_mdb1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (cdt s)\<rbrace>
 4. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 5. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 6. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes1 s)\<rbrace> setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode) \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 7. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 8. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'1 s)\<rbrace> setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode) \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 9. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 10. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'1 s)\<rbrace> setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode) \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
A total of 43 subgoals... proof (prove)
goal (43 subgoals):
 1. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_caps1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (caps_of_state s)\<rbrace>
 2. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_mdb1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (cdt s)\<rbrace>
 3. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 4. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 5. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes1 s)\<rbrace> setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode) \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 6. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 7. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'1 s)\<rbrace> setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode) \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 8. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 9. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'1 s)\<rbrace> setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode) \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
 10. \<And>P. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct1 s)\<rbrace> do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od \<lbrace>\<lambda>rv s. P (cur_thread s)\<rbrace>
A total of 43 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s \<and> valid_pspace s \<and> valid_mdb s \<and> valid_list s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) s' \<and> valid_mdb' s' \<and> valid_pspace' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_relation ((\<noteq>) None \<circ> (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a)) (cdt s) (\<lambda>a. if a = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' a)
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 9. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (9 subgoals):
 1. \<And>s s' a b cte. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (\<lambda>a. if a = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' a)
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 9. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (9 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (\<lambda>a. if a = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' a)
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 9. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (9 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 9. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (14 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> no_0 (ctes_of s')
 2. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s')
 3. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> ctes_of s' (cte_map sl) = Some (CTE capability.NullCap (?node283 s s' a b x2))
 4. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbPrev (?node283 s s' a b x2) = 0
 5. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.ReplyCap thread True True) initMDBNode)) = 0
 6. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 9. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 10. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s')
 2. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> ctes_of s' (cte_map sl) = Some (CTE capability.NullCap (?node283 s s' a b x2))
 3. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbPrev (?node283 s s' a b x2) = 0
 4. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.ReplyCap thread True True) initMDBNode)) = 0
 5. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 9. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 10. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> ctes_of s' (cte_map sl) = Some (CTE capability.NullCap (?node283 s s' a b x2))
 2. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbPrev (?node283 s s' a b x2) = 0
 3. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.ReplyCap thread True True) initMDBNode)) = 0
 4. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 9. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 10. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbPrev x2 = 0
 2. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.ReplyCap thread True True) initMDBNode)) = 0
 3. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 9. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 10. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.ReplyCap thread True True) initMDBNode)) = 0
 2. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 9. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 10. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (9 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 9. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (10 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b)); cte_wp_at (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 2. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) s
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 9. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 10. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (10 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b))\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) s
 2. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b)); cte_wp_at (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 9. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 10. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (9 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; None \<noteq> (if (a, b) = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s (a, b)); cte_wp_at (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 9. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (cdt (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b cap node cte. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b cap node x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b cap node x2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); \<forall>a b cap node. ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b cap x2. \<lbrakk>pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); \<forall>a b cap node. ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; cte_map (a, b) = cte_map sl; capability.ReplyCap thread True True = cap\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b cap x2. \<lbrakk>pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; cte_map (a, b) = cte_map sl; capability.ReplyCap thread True True = cap; \<forall>cap node. ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; cte_map (a, b) = cte_map sl; case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext x2 = cte_map next\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (9 subgoals):
 1. \<And>s s' a b x2. \<lbrakk>pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; cte_map (a, b) = cte_map sl; case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext x2 = cte_map next; next_slot (a, b) (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0
 2. \<And>s s' a b x2 aa. \<lbrakk>pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; cte_map (a, b) = cte_map sl; case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext x2 = cte_map next; next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 8. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 9. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b x2 aa. \<lbrakk>pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; cte_map (a, b) = cte_map sl; case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext x2 = cte_map next; next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> cte_map next = 0
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (8 subgoals):
 1. \<And>s s' a b x2 aa. \<lbrakk>pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; sl' = cte_map sl; AllowGrant \<in> rights; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some (CTE capability.NullCap x2); valid_mdb s; valid_list s; mdbPrev x2 = 0; cte_map (a, b) = cte_map sl; mdbNext x2 = cte_map aa; next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_map aa = 0
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 7. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 8. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (7 subgoals):
 1. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksSchedulerAction s')
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 6. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 7. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (6 subgoals):
 1. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksReadyQueues s')
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 6. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (null_filter ((caps_of_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>))(sl \<mapsto> cap.ReplyCap thread True rights))) ((ctes_of s')(cte_map sl \<mapsto> CTE (capability.ReplyCap thread True True) initMDBNode))
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 5. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (5 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (if (a, b) = sl then True else is_original_cap s (a, b)) = mdbRevocable node
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 5. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (5 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> ((a, b) = sl \<longrightarrow> mdbRevocable node) \<and> ((a, b) \<noteq> sl \<longrightarrow> is_original_cap s (a, b) = mdbRevocable node)
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 5. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (a, b) = sl \<longrightarrow> mdbRevocable node
 2. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> sl \<longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 6. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (5 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (a, b) \<noteq> sl \<longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 5. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (5 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 5. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 2. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl\<rbrakk> \<Longrightarrow> null_filter (caps_of_state s) (a, b) \<noteq> None
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 6. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl\<rbrakk> \<Longrightarrow> null_filter (caps_of_state s) (a, b) \<noteq> None
 2. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 6. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (5 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 5. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None; cte_wp_at (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 2. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) s
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 6. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) s
 2. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None; cte_wp_at (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 6. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' a b cte y cap node ya. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) = Some ya\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) s
 2. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None; cte_wp_at (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 6. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' a b cte y cap node ya. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; cte_wp_at (\<lambda>c'. c' = ya \<and> c' \<noteq> cap.NullCap) (a, b) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) s
 2. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None; cte_wp_at (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 5. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 6. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (5 subgoals):
 1. \<And>s s' a b cte y cap node. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) sl s; valid_pspace s; valid_mdb' s'; valid_pspace' s'; ctes_of s' (cte_map sl) = Some cte; valid_mdb s; valid_list s; cteCap cte = capability.NullCap; mdbPrev (cteMDBNode cte) = 0; null_filter (\<lambda>a. if a = sl then Some (cap.ReplyCap thread True rights) else caps_of_state s a) (a, b) = Some y; (if cte_map (a, b) = cte_map sl then Some (CTE (capability.ReplyCap thread True True) initMDBNode) else ctes_of s' (cte_map (a, b))) = Some (CTE cap node); (a, b) \<noteq> sl; null_filter (caps_of_state s) (a, b) \<noteq> None; cte_wp_at (\<lambda>_. True) (a, b) s\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 4. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 5. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (4 subgoals):
 1. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>), ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (interrupt_states (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) (ksInterruptState s') \<and> cur_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurThread s' \<and> idle_thread (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksIdleThread s' \<and> machine_state (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksMachineState s' \<and> domain_index (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomScheduleIdx s' \<and> domain_list (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomSchedule s' \<and> cur_domain (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksCurDomain s' \<and> domain_time (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksDomainTime s' \<and> work_units_completed (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>) = ksWorkUnitsCompleted s'
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 3. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 4. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsUserPages s'
 2. \<And>s s'. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)) = gsCNodes s'
 3. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode)) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc ?Q450 ?Q'450 (do y <- set_original sl True;
set_cap (cap.ReplyCap thread True rights) sl
od) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode))
 2. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s\<rbrakk> \<Longrightarrow> ?Q450 s
 3. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s\<rbrakk> \<Longrightarrow> ?Q'450 s proof (prove)
goal (4 subgoals):
 1. \<And>rv. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q454 rv) ?Q'450 (set_cap (cap.ReplyCap thread True rights) sl) (setCTE (cte_map sl) (CTE (capability.ReplyCap thread True True) initMDBNode))
 2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>?Q450\<rbrace> set_original sl True \<lbrace>?Q454\<rbrace>
 3. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s\<rbrakk> \<Longrightarrow> ?Q450 s
 4. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s\<rbrakk> \<Longrightarrow> ?Q'450 s proof (prove)
goal (4 subgoals):
 1. \<And>rv. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> cap_relation (cap.ReplyCap thread True rights) (cteCap (CTE (capability.ReplyCap thread True True) initMDBNode))
 2. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>?Q450\<rbrace> set_original sl True \<lbrace>\<lambda>rv. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) sl\<rbrace>
 3. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s\<rbrakk> \<Longrightarrow> ?Q450 s
 4. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map sl)) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights\<rbrakk> \<Longrightarrow> \<lbrace>?Q450\<rbrace> set_original sl True \<lbrace>\<lambda>rv. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) sl\<rbrace>
 2. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s\<rbrakk> \<Longrightarrow> ?Q450 s
 3. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map sl)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at ((=) cap.NullCap) sl and valid_pspace and valid_mdb and valid_list) s\<rbrakk> \<Longrightarrow> (pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) sl) (s\<lparr>is_original_cap := (is_original_cap s)(sl := True)\<rparr>)
 2. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map sl)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>sl' = cte_map sl; AllowGrant \<in> rights; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap \<and> mdbPrev (cteMDBNode c) = 0) (cte_map sl) and valid_mdb' and valid_pspace') s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map sl)) s proof (prove)
goal:
No subgoals!