theory CSpace_C

lemma cteInsert_ccorres:
  "ccorres dc xfdc (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap
                                        \<or> is_simple_cap' cap) src
                     and valid_mdb' and valid_objs'
                     and pspace_aligned' and (valid_cap' cap)
                     and (\<lambda>s. cte_wp_at' (\<lambda>c. True) src s))
             (UNIV
                \<inter> {s. destSlot_' s = Ptr dest} \<inter> {s. srcSlot_' s = Ptr src} \<inter> {s. ccap_relation cap (newCap_' s)}
                \<inter> {s. destSlot_' s = Ptr dest} \<inter> {s. srcSlot_' s = Ptr src} \<inter> {s. ccap_relation cap (newCap_' s)}) []
             (cteInsert cap src dest)
             (Call cteInsert_'proc)" apply (cinit (no_ignore_call) lift: destSlot_' srcSlot_' newCap_'
                            simp del: return_bind
                            simp add: Collect_const) apply (rule ccorres_move_c_guard_cte) apply (ctac pre: ccorres_pre_getCTE) apply (rule ccorres_move_c_guard_cte) apply (ctac pre: ccorres_pre_getCTE) apply (ctac(no_vcg) add: revokable_ccorres) apply (ctac (c_lines 3) add: cteInsert_ccorres_mdb_helper) apply (simp del: Collect_const) apply (rule ccorres_pre_getCTE ccorres_assert)+ apply (ctac add: setUntypedCapAsFull_ccorres) apply (rule ccorres_move_c_guard_cte) apply (ctac) apply (rule ccorres_move_c_guard_cte) apply ctac apply (rule ccorres_move_c_guard_cte) apply (ctac(no_vcg)) apply csymbr apply (erule_tac t = ret__unsigned in ssubst) apply (rule ccorres_cond_both [where R = \<top>, simplified]) apply (erule mdbNext_not_zero_eq) apply csymbr apply simp apply (rule ccorres_move_c_guard_cte) apply (ctac ccorres:ccorres_updateMDB_set_mdbPrev) apply (ctac ccorres: ccorres_updateMDB_skip) apply (wp hoare_weak_lift_imp)+ apply (clarsimp simp: Collect_const_mem split del: if_split) apply vcg apply (wp hoare_weak_lift_imp) apply (clarsimp simp: Collect_const_mem split del: if_split) apply vcg apply (clarsimp simp:cmdb_node_relation_mdbNext) apply (wp setUntypedCapAsFull_cte_at_wp hoare_weak_lift_imp) apply (clarsimp simp: Collect_const_mem split del: if_split) apply (vcg exspec=setUntypedCapAsFull_modifies) apply wp apply vcg apply wp apply wp apply vcg apply wp apply vcg apply (simp add: Collect_const_mem split del: if_split) \<comment> \<open>Takes a while\<close> apply (rule conjI) apply (clarsimp simp: conj_comms cte_wp_at_ctes_of) apply (intro conjI) apply clarsimp apply simp apply simp apply clarsimp apply (rule conjI) apply (clarsimp simp: isUntypedCap_def split: capability.split_asm) apply (frule valid_cap_untyped_inv) apply clarsimp apply (rule conjI) apply (case_tac ctea) apply (clarsimp simp: isUntypedCap_def split: capability.splits) apply (frule valid_cap_untyped_inv[OF ctes_of_valid_cap']) apply fastforce apply clarsimp+ apply (drule valid_dlist_nextD) apply (simp add:valid_mdb'_def valid_mdb_ctes_def) apply simp apply clarsimp apply (clarsimp simp: map_comp_Some_iff cte_wp_at_ctes_of
             split del: if_split) apply (clarsimp simp: typ_heap_simps c_guard_clift split_def) apply (clarsimp simp: ccte_relation_ccap_relation cmdb_node_relation_mdbNext[symmetric]) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) (UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>) [] (cteInsert cap src dest) (Call cteInsert_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>newCap srcSlot destSlot. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1753 newCap srcSlot destSlot) (?Q'1753 newCap srcSlot destSlot) [SKIP] (do srcCTE <- getCTE src;
srcMDB <- return (cteMDBNode srcCTE);
srcCap <- return (cteCap srcCTE);
newCapIsRevocable <- return (revokable' srcCap cap);
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src) srcMDB)));
oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull srcCap cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])));;
(\<acute>newCapIsRevocable :== CALL isCapRevocable_'proc(newCap,\<acute>srcCap);;
(\<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(\<acute>srcMDB,ptr_val srcSlot);;
(\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(CALL setUntypedCapAsFull_'proc(\<acute>srcCap,newCap,srcSlot);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>newMDB)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot))
FI)))))))))))
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1753 newCap srcSlot destSlot s \<and> s' \<in> ?Q'1753 newCap srcSlot destSlot proof (prove)
goal (2 subgoals):
 1. \<And>newCap srcSlot destSlot. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1759 newCap srcSlot destSlot) (?C'1759 newCap srcSlot destSlot) [SKIP] (do srcCTE <- getCTE src;
srcMDB <- return (cteMDBNode srcCTE);
srcCap <- return (cteCap srcCTE);
newCapIsRevocable <- return (revokable' srcCap cap);
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src) srcMDB)));
oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull srcCap cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (\<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])));;
(\<acute>newCapIsRevocable :== CALL isCapRevocable_'proc(newCap,\<acute>srcCap);;
(\<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(\<acute>srcMDB,ptr_val srcSlot);;
(\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(CALL setUntypedCapAsFull_'proc(\<acute>srcCap,newCap,srcSlot);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>newMDB)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot))
FI)))))))))))
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> (?A1759 newCap srcSlot destSlot and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> ?C'1759 newCap srcSlot destSlot \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1764 newCap srcSlot destSlot srcCTE rv) (?Q'1764 newCap srcSlot destSlot srcCTE rv srcMDB) [SKIP] (do srcCap <- return (cteCap srcCTE);
newCapIsRevocable <- return (revokable' srcCap cap);
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src) rv)));
oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull srcCap cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])));;
(\<acute>newCapIsRevocable :== CALL isCapRevocable_'proc(newCap,\<acute>srcCap);;
(\<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
(\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(CALL setUntypedCapAsFull_'proc(\<acute>srcCap,newCap,srcSlot);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>newMDB)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot))
FI))))))))))
 2. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>?Q1764 newCap srcSlot destSlot srcCTE\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> ?Q'1764 newCap srcSlot destSlot srcCTE rv (srcMDB_' s)}
 4. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A2109 newCap srcSlot destSlot srcCTE rv) (?C'2108 newCap srcSlot destSlot srcCTE rv srcMDB) [SKIP] (do srcCap <- return (cteCap srcCTE);
newCapIsRevocable <- return (revokable' srcCap cap);
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src) rv)));
oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull srcCap cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (\<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']));;
(\<acute>newCapIsRevocable :== CALL isCapRevocable_'proc(newCap,\<acute>srcCap);;
(\<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
(\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(CALL setUntypedCapAsFull_'proc(\<acute>srcCap,newCap,srcSlot);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>newMDB)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot))
FI))))))))))
 2. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. ?A2109 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> ?C'2108 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2114 newCap srcSlot destSlot srcCTE rv srcMDB rva) (?Q'2114 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap) [SKIP] (do newCapIsRevocable <- return (revokable' rva cap);
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src) rv)));
oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull rva cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (\<acute>newCapIsRevocable :== CALL isCapRevocable_'proc(newCap,srcCap);;
(\<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
(\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,\<acute>newCapIsRevocable);;
(CALL setUntypedCapAsFull_'proc(srcCap,newCap,srcSlot);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>newMDB)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot))
FI)))))))))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>?Q2114 newCap srcSlot destSlot srcCTE rv srcMDB\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> ?Q'2114 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s)}
 4. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2444 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb) (?Q'2444 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) [SKIP] (do newMDB <- return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv)));
oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull rva cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (\<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
(\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
(\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable);;
(CALL setUntypedCapAsFull_'proc(srcCap,newCap,srcSlot);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) \<acute>newMDB)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(\<acute>newMDB);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot))
FI))))))))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>?Q2444 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'2444 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 5. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB) (?Q'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca) [SKIP] (do oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull rva cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (CALL setUntypedCapAsFull_'proc(srcCap,newCap,srcSlot);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c destSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) xfdca)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),ptr_val destSlot))
FI)))))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>?Q2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> ?Q'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s)}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 7. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2747 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB) (?Q'2747 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca) [SKIP] (do oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull rva cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr dest} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr dest} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr src} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']),dest));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI)))))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>?Q2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> ?Q'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s)}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 7. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2981 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE) (?P'2976 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) [SKIP] (do y <- setUntypedCapAsFull rva cap src;
y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr dest} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr dest} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr src} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']),dest));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI)))))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> ?P2981 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte b\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'2975 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 7. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?P'2976 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?P'2975 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (11 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2992 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc) (?Q'2992 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) [SKIP] (do y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr dest} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr dest} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr src} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']),dest));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI))))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>?Q2992 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> ?Q'2992 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s)}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 9. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (11 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3049 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc) (?C'3046 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) [SKIP] (do y <- updateCap dest cap;
y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr dest} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr src} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']),dest));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI))))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. ?A3049 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> ?C'3046 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 9. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (13 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd) (?Q'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) [SKIP] (do y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr dest} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr src} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']),dest));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI)))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>?Q3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> ?Q'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s)}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (13 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3096 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd) (?C'3093 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) [SKIP] (do y <- updateMDB dest (const newMDB);
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr src} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']),dest));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI)))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. ?A3096 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> ?C'3093 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (15 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve) (?Q'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd) [SKIP] (do y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr src} (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']),dest));;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>?Q3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> ?Q'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s)}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (15 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3143 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve) (?C'3140 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd) [SKIP] (do y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od) (CALL mdb_node_ptr_set_mdbNext_'proc(mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']),dest);;
(\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. ?A3143 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> ?C'3140 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (16 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3148 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Q'3148 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI)
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>?Q3148 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3148 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t)} \<inter> \<lbrace>True\<rbrace>}
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (16 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce; ret__unsigned = mdbNext_CL (mdb_node_lift xfdca)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3148 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?G'3199 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) (IF ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI)
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>?Q3148 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3199 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v}} \<inter> \<lbrace>True\<rbrace>}
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (16 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3148 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?G'3295 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) (IF mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest))
FI)
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>?Q3148 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3295 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v}} \<inter> \<lbrace>True\<rbrace>}
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (18 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdc ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdc\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<longrightarrow> ?P3317 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf s = (s' \<in> \<lbrace>mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0\<rbrace>)
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3316 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Rt3306 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest)))
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) SKIP
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>\<lambda>a. (\<lambda>s. ?P3317 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s \<longrightarrow> ?Pt3316 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s) and (\<lambda>s. \<not> ?P3317 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s \<longrightarrow> ?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s)\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?Rt3306 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v \<inter> \<lbrace>v \<noteq> 0\<rbrace> \<union> ?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
A total of 18 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (17 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3316 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Rt3306 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) (\<acute>ret__unsigned :== CALL mdb_node_get_mdbNext_'proc(xfdca);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (ret__unsigned_' s)} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr \<acute>ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest)))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) SKIP
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>\<lambda>a. (\<lambda>s. mdbNext newMDB \<noteq> 0 \<longrightarrow> ?Pt3316 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s) and (\<lambda>s. \<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> ?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s)\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?Rt3306 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v \<inter> \<lbrace>v \<noteq> 0\<rbrace> \<union> ?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (17 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce; ret__unsigned = mdbNext_CL (mdb_node_lift xfdca)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3316 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?G'3331 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigneda (mdbNext_CL (mdb_node_lift xfdca)) ret__unsigned) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ret__unsigned} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr ret__unsigned\<rightarrow>[''cteMDBNode_C'']),dest)))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) SKIP
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>\<lambda>a. (\<lambda>s. mdbNext newMDB \<noteq> 0 \<longrightarrow> ?Pt3316 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s) and (\<lambda>s. \<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> ?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s)\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'3331 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v va} \<inter> \<lbrace>v \<noteq> 0\<rbrace> \<union> ?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (17 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE xfdcb xfdcc xfdcd xfdce ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; ret__unsigned = mdbNext_CL (mdb_node_lift xfdca)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt3316 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE () xfdcb () xfdcc () xfdcd ()) (?G'3331 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE () xfdcb () xfdcc () xfdcd () xfdce ret__unsigneda (mdbNext_CL (mdb_node_lift xfdca)) (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))} (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']),dest)))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) SKIP
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>\<lambda>a. (\<lambda>s. mdbNext newMDB \<noteq> 0 \<longrightarrow> ?Pt3316 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s) and (\<lambda>s. \<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> ?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s)\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'3331 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v va} \<inter> \<lbrace>v \<noteq> 0\<rbrace> \<union> ?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (17 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE xfdcb xfdcc xfdcd xfdce ret__unsigneda ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; ret__unsigned = mdbNext_CL (mdb_node_lift xfdca)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3401 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE () xfdcb () xfdcc () xfdcd ()) (?C'3398 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE () xfdcb () xfdcc () xfdcd () xfdce ret__unsigneda (mdbNext_CL (mdb_node_lift xfdca)) (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) (CALL mdb_node_ptr_set_mdbPrev_'proc(mdb_Ptr &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']),dest))
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) SKIP
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>\<lambda>a. (\<lambda>s. mdbNext newMDB \<noteq> 0 \<longrightarrow> (?A3401 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))))) s) and (\<lambda>s. \<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> ?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s)\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> ?C'3398 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>v \<noteq> 0\<rbrace> \<union> ?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (16 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdcd; dc rvf xfdce\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf) (?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdcd rvf xfdce ret__unsigned (mdbNext_CL (mdb_node_lift xfdca))) [SKIP] (updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))) SKIP
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>\<lambda>a. (\<lambda>s. mdbNext newMDB \<noteq> 0 \<longrightarrow> ((\<lambda>a. mdbNext newMDB \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))))) s) and (\<lambda>s. \<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> ?Pf3312 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc a s)\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rve. dc rve (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rvf. dc rvf (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr v\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>v \<noteq> 0\<rbrace> \<union> ?Rf3305 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve (xfdc s) rvf (xfdc t) v v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (15 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc; dc rve xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc rve\<rbrace> updateMDB src (mdbNext_update (\<lambda>_. dest)) \<lbrace>\<lambda>a. (\<lambda>s. mdbNext newMDB \<noteq> 0 \<longrightarrow> ((\<lambda>a. mdbNext newMDB \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))))) s) and (\<lambda>s. \<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> ((\<lambda>_. True) and (\<lambda>_. mdbNext newMDB = 0)) s)\<rbrace>
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd\<rbrace> updateMDB dest (const newMDB) \<lbrace>\<lambda>a. (\<lambda>a. src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) and ?R3152 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src))\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr v\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>v \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and ?R3105 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (13 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb; dc rvd xfdcc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd xfdcc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. \<forall>v. v = mdbNext_CL (mdb_node_lift (mdb_node_' (mdb_node_'_update (\<lambda>_. xfdca) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. v32_'_update (\<lambda>_. dest) (mdb_node_ptr_'_update (\<lambda>_. mdb_Ptr &(cte_Ptr v\<rightarrow>[''cteMDBNode_C''])) s) \<in> \<lbrace>\<acute>mdb_node_ptr = mdb_Ptr &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = dest\<rbrace>} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>v \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and (\<lambda>a. (src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> (mdbNext newMDB \<noteq> 0 \<longrightarrow> (mdbNext newMDB \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdca)))) a) \<and> (\<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> True \<and> mdbNext newMDB = 0) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src)) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (13 subgoals):
 1. \<And>newCap srcCTE rv srcMDB rva srcCap rvb newMDB xfdca oldCTE xfdcb xfdc. \<lbrakk>ccap_relation cap newCap; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3101 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb (from_bool rvb) newMDB xfdca oldCTE () xfdcb () xfdc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(cte_Ptr dest\<rightarrow>[''cteMDBNode_C''])) xfdca)) (if &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift xfdca) = 0 then UNIV else {})
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and (\<lambda>a. (src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> (mdbNext newMDB \<noteq> 0 \<longrightarrow> (mdbNext newMDB \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdca)))) a) \<and> (\<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> True \<and> mdbNext newMDB = 0) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src)) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rvd. dc rvd (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3101 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb rvd (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
A total of 13 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (12 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdc. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc\<rbrace> updateCap dest cap \<lbrace>\<lambda>a. (\<lambda>a. dest \<noteq> 0) and (\<lambda>a. (src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> (mdbNext newMDB \<noteq> 0 \<longrightarrow> (mdbNext newMDB \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdca)))) a) \<and> (\<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> True \<and> mdbNext newMDB = 0) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src)) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> {s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) xfdca))) s \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift xfdca) = 0 then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R3058 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 10. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (11 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer; dc rvc xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc xfdcb) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>cmdbnode_relation newMDB xfdca\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> {s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (mdb_Ptr &(destSlot\<rightarrow>[''cteMDBNode_C''])) xfdca))) s \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift xfdca) = 0 then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. dest \<noteq> 0 \<and> (src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> (mdbNext newMDB \<noteq> 0 \<longrightarrow> (mdbNext newMDB \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdc)))) a) \<and> (\<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> True \<and> mdbNext newMDB = 0) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src)) a \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest)) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 9. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (11 subgoals):
 1. \<And>newCap srcCTE rv srcMDB rva srcCap rvb newMDB xfdca oldCTE xfdc. \<lbrakk>ccap_relation cap newCap; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3054 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb (from_bool rvb) newMDB xfdca oldCTE () xfdc) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr dest\<rightarrow>[''cap_C''])) newCap)) (if &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift xfdca) = 0 then UNIV else {})
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. dest \<noteq> 0 \<and> (src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> (mdbNext newMDB \<noteq> 0 \<longrightarrow> (mdbNext newMDB \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdc)))) a) \<and> (\<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> True \<and> mdbNext newMDB = 0) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src)) a \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest)) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> ?R'3054 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE rvc (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 9. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 10. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (10 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. dest \<noteq> 0 \<and> (src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> (mdbNext newMDB \<noteq> 0 \<longrightarrow> (mdbNext newMDB \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3)) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (mdbNext_CL (mdb_node_lift xfdc)))) a) \<and> (\<not> mdbNext newMDB \<noteq> 0 \<longrightarrow> True \<and> mdbNext newMDB = 0) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr src)) a \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest)) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr dest))\<rbrace>
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> {s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap))) s \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift xfdca) = 0 then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 8. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 10. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (10 subgoals):
 1. \<And>newCap srcCTE rv srcMDB rva srcCap rvb newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?R3003 newCap (cte_Ptr src) (cte_Ptr dest) srcCTE rv srcMDB rva srcCap rvb (from_bool rvb) newMDB oldCTE\<rbrace> setUntypedCapAsFull rva cap src \<lbrace>\<lambda>a b. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext newMDB \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext newMDB) b) \<and> cte_wp_at' (\<lambda>_. True) src b \<and> cte_wp_at' (\<lambda>_. True) dest b\<rbrace>
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> {s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap))) s \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift xfdca) = 0 then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and ?R3003 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable a cte) b\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 8. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 9. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 10. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (9 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable; cmdbnode_relation newMDB xfdca; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdca oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>ccap_relation cap newCap\<rbrace> \<inter> \<lbrace>cte_Ptr dest = cte_Ptr dest\<rbrace> \<inter> {s. globals_update (t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(destSlot\<rightarrow>[''cap_C''])) newCap))) s \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdca))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift xfdca) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift xfdca) = 0 then UNIV else {})} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and (\<lambda>b. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext a \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext a) b) \<and> cte_wp_at' (\<lambda>_. True) src b \<and> cte_wp_at' (\<lambda>_. True) dest b)) b\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 7. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (9 subgoals):
 1. \<And>newCap srcCTE rv srcMDB rva srcCap rvb newMDB xfdc oldCTE. \<lbrakk>ccap_relation cap newCap; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; cmdbnode_relation newMDB xfdc; cteCap oldCTE = capability.NullCap; mdbPrev (cteMDBNode oldCTE) = nullPointer; mdbNext (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb (from_bool rvb) newMDB xfdc oldCTE) CALL setUntypedCapAsFull_'proc(srcCap,newCap,cte_Ptr src) (if &(cte_Ptr (mdbNext_CL (mdb_node_lift xfdc))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift xfdc) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift xfdc) = 0 then UNIV else {})
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and (\<lambda>b. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext a \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext a) b) \<and> cte_wp_at' (\<lambda>_. True) src b \<and> cte_wp_at' (\<lambda>_. True) dest b)) b\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'2995 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB (newMDB_' s) cte'}}
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 7. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 8. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc cte'. ?R'2999 newCap srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable newMDB xfdc (cte_to_H cte') \<equiv>\<^sup>? \<lambda>newCap. ?R'2995 newCap (cte_Ptr src) (cte_Ptr dest) proof (prove)
goal (8 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<lbrace>?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace> return (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<lbrace>\<lambda>a b. \<forall>cte. ctes_of b dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and (\<lambda>b. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext a \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext a) b) \<and> cte_wp_at' (\<lambda>_. True) src b \<and> cte_wp_at' (\<lambda>_. True) dest b)) b\<rbrace>
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {sa. \<forall>t. sa\<lparr>globals := globals sa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift (newMDB_' s)))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (newMDB_' s)) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (newMDB_' s)) = 0 then UNIV else {})}}}
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and ?R2749 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 6. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 7. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap; from_bool rvb = newCapIsRevocable\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap rvb newCapIsRevocable) \<acute>newMDB :== CALL mdb_node_set_mdbPrev_'proc(srcMDB,ptr_val srcSlot);;
\<acute>newMDB :== CALL mdb_node_set_mdbRevocable_'proc(\<acute>newMDB,newCapIsRevocable);;
\<acute>newMDB :== CALL mdb_node_set_mdbFirstBadged_'proc(\<acute>newMDB,newCapIsRevocable) {s. \<forall>newMDB. cmdbnode_relation newMDB (newMDB_' s) \<longrightarrow> s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {s. srcSlot_'_update (\<lambda>x. srcSlot) (newCap_'_update (\<lambda>x. newCap) (srcCap_'_update (\<lambda>x. srcCap) s)) \<in> UNIV \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {sa. \<forall>t. sa\<lparr>globals := globals sa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift (newMDB_' s)))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (newMDB_' s)) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (newMDB_' s)) = 0 then UNIV else {})}}}
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and (\<lambda>a. \<forall>cte. ctes_of a dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and (\<lambda>a. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv)))) a) \<and> cte_wp_at' (\<lambda>_. True) src a \<and> cte_wp_at' (\<lambda>_. True) dest a)) a)\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rva \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rvb. from_bool rvb = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> ?R'2747 newCap srcSlot destSlot srcCTE rv srcMDB rva (srcCap_' s) rvb (ret__unsigned_long_' t)}}
 5. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 6. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB rva srcCap. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB; ccap_relation rva srcCap\<rbrakk> \<Longrightarrow> \<lbrace>?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace> return (revokable' rva cap) \<lbrace>\<lambda>rvb. K (is_aligned src 3) and (\<lambda>a. \<forall>cte. ctes_of a dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and (\<lambda>a. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv))) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (mdbFirstBadged_update (\<lambda>_. rvb) (mdbRevocable_update (\<lambda>_. rvb) (mdbPrev_update (\<lambda>_. src) rv)))) a) \<and> cte_wp_at' (\<lambda>_. True) src a \<and> cte_wp_at' (\<lambda>_. True) dest a)) a)\<rbrace>
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and ?R2446 newCap srcSlot destSlot srcCTE rv srcMDB rva\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> {sa. \<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1, mdbFirstBadged_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> ccap_relation rv (srcCap_' s) \<and> ccap_relation cap newCap \<and> (\<forall>t. sa\<lparr>newMDB_' := ret__struct_mdb_node_C_' ta, globals := globals sa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift srcMDB))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift srcMDB) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift srcMDB) = 0 then UNIV else {}))))))}}}
 4. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 5. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<lbrace>?R2117 newCap srcSlot destSlot srcCTE rv\<rbrace> return (cteCap srcCTE) \<lbrace>\<lambda>rva. (\<lambda>_. capMasterCap cap = capMasterCap rva \<or> is_simple_cap' cap) and (K (is_aligned src 3) and (\<lambda>a. \<forall>cte. ctes_of a dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = rva) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap rva \<longrightarrow> minUntypedSizeBits \<le> capBlockSize rva) and (\<lambda>a. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' rva cap) (mdbRevocable_update (\<lambda>_. revokable' rva cap) (mdbPrev_update (\<lambda>_. src) rv))) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' rva cap) (mdbRevocable_update (\<lambda>_. revokable' rva cap) (mdbPrev_update (\<lambda>_. src) rv)))) a) \<and> cte_wp_at' (\<lambda>_. True) src a \<and> cte_wp_at' (\<lambda>_. True) dest a)) a))\<rbrace>
 2. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> {sa. \<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1, mdbFirstBadged_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> ccap_relation rv (srcCap_' s) \<and> ccap_relation cap newCap \<and> (\<forall>t. sa\<lparr>newMDB_' := ret__struct_mdb_node_C_' ta, globals := globals sa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift srcMDB))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift srcMDB) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift srcMDB) = 0 then UNIV else {}))))))}}}
 3. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ?R2117 newCap srcSlot destSlot srcCTE rv and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 4. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 5. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE rv srcMDB. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; cmdbnode_relation rv srcMDB\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2114 newCap srcSlot destSlot srcCTE rv srcMDB) \<acute>srcCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (srcCap_' s) \<longrightarrow> s \<in> {sa. srcCap_'_update (\<lambda>x. srcCap_' s) (derivedCap_'_update (\<lambda>_. newCap) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>srcCap\<rbrace>} \<inter> {s'. \<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> newCapIsRevocable_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV \<inter> {sa. \<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift srcMDB\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1, mdbFirstBadged_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> ccap_relation rv (srcCap_' s) \<and> ccap_relation cap newCap \<and> (\<forall>t. sa\<lparr>newMDB_' := ret__struct_mdb_node_C_' ta, globals := globals sa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift srcMDB))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift srcMDB) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift srcMDB) = 0 then UNIV else {}))))))}}}
 2. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ((\<lambda>_. capMasterCap cap = capMasterCap (cteCap srcCTE) \<or> is_simple_cap' cap) and (K (is_aligned src 3) and (\<lambda>a. \<forall>cte. ctes_of a dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap srcCTE) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap (cteCap srcCTE) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap srcCTE)) and (\<lambda>a. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) rv))) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) rv)))) a) \<and> cte_wp_at' (\<lambda>_. True) src a \<and> cte_wp_at' (\<lambda>_. True) dest a)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 3. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> ?R'2114 newCap srcSlot destSlot srcCTE rv (srcMDB_' s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<lbrace>?R1764 newCap srcSlot destSlot srcCTE\<rbrace> return (cteMDBNode srcCTE) \<lbrace>\<lambda>rv. (\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot srcCTE rv) = Some srcCTE) and ((\<lambda>_. capMasterCap cap = capMasterCap (cteCap srcCTE) \<or> is_simple_cap' cap) and (K (is_aligned src 3) and (\<lambda>a. \<forall>cte. ctes_of a dest = Some cte \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap srcCTE) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap (cteCap srcCTE) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap srcCTE)) and (\<lambda>a. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) rv))) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) rv)))) a) \<and> cte_wp_at' (\<lambda>_. True) src a \<and> cte_wp_at' (\<lambda>_. True) dest a)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>
 2. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> {sa. \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<longrightarrow> True \<and> ccap_relation cap newCap \<and> ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> True \<and> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (srcMDB_' s)\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (srcMDB_' s)\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (srcMDB_' s)\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1, mdbFirstBadged_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift t) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<and> ccap_relation cap newCap \<and> (\<forall>tb. sa\<lparr>srcCap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])), newCapIsRevocable_' := ret__unsigned_long_' t, newMDB_' := ret__struct_mdb_node_C_' ta, globals := globals t\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr> \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift (srcMDB_' s)))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (srcMDB_' s)) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (srcMDB_' s)) = 0 then UNIV else {}))))))))} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ?R1764 newCap srcSlot destSlot cte) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>newCap srcSlot destSlot srcCTE. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1764 newCap srcSlot destSlot srcCTE) \<acute>srcMDB :== h_val (hrs_mem \<acute>t_hrs) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])) {s. \<forall>rv. cmdbnode_relation rv (srcMDB_' s) \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot srcCTE rv\<rbrace> \<inter> {sa. \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<longrightarrow> True \<and> ccap_relation cap newCap \<and> ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> True \<and> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (srcMDB_' s)\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (srcMDB_' s)\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (srcMDB_' s)\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1, mdbFirstBadged_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift t) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<and> ccap_relation cap newCap \<and> (\<forall>tb. sa\<lparr>srcCap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])), newCapIsRevocable_' := ret__unsigned_long_' t, newMDB_' := ret__struct_mdb_node_C_' ta, globals := globals t\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr> \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift (srcMDB_' s)))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (srcMDB_' s)) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (srcMDB_' s)) = 0 then UNIV else {}))))))))} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ((\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot cte (cteMDBNode cte)) = Some cte) and ((\<lambda>_. capMasterCap cap = capMasterCap (cteCap cte) \<or> is_simple_cap' cap) and (K (is_aligned src 3) and (\<lambda>a. \<forall>ctea. ctes_of a dest = Some ctea \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap (cteCap cte) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap cte)) and (\<lambda>a. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte))))) a) \<and> cte_wp_at' (\<lambda>_. True) src a \<and> cte_wp_at' (\<lambda>_. True) dest a)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot))) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> ?R'1764 newCap srcSlot destSlot (cte_to_H cte')} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' cap and cte_wp_at' (\<lambda>c. True) src) s; s' \<in> \<lbrace>\<acute>destSlot = cte_Ptr dest\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr src\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>newCap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ((\<lambda>s. ctes_of s (?ptr1766 newCap srcSlot destSlot cte) = Some cte) and ((\<lambda>a. ctes_of a (?ptr2122 newCap srcSlot destSlot cte (cteMDBNode cte)) = Some cte) and ((\<lambda>_. capMasterCap cap = capMasterCap (cteCap cte) \<or> is_simple_cap' cap) and (K (is_aligned src 3) and (\<lambda>a. \<forall>ctea. ctes_of a dest = Some ctea \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) src and valid_mdb' and pspace_aligned' and valid_objs' and K (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) and K (isUntypedCap (cteCap cte) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap cte)) and (\<lambda>a. dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte))))) a) \<and> cte_wp_at' (\<lambda>_. True) src a \<and> cte_wp_at' (\<lambda>_. True) dest a)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot))) s) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) s \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> \<lbrace>ptr_val srcSlot = ?ptr1766 newCap srcSlot destSlot (cte_to_H cte')\<rbrace> \<inter> {s. \<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> ptr_val srcSlot = ?ptr2122 newCap srcSlot destSlot (cte_to_H cte') rv \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<longrightarrow> True \<and> ccap_relation cap newCap \<and> ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> True \<and> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := ptr_val srcSlot && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && mask 1, mdbFirstBadged_CL := ret__unsigned_long_' t && mask 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift t) destSlot = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) \<and> ccap_relation cap newCap \<and> (\<forall>tb. s\<lparr>srcMDB_' := h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])), srcCap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])), newCapIsRevocable_' := ret__unsigned_long_' t, newMDB_' := ret__struct_mdb_node_C_' ta, globals := globals t\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr> \<in> (if &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s))) (mdb_Ptr &(srcSlot\<rightarrow>[''cteMDBNode_C''])))) = 0 then UNIV else {}))))))))) \<and> True}} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s src = Some cte \<longrightarrow> ctes_of s (?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) cte) = Some cte \<and> ctes_of s (?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) cte (cteMDBNode cte)) = Some cte \<and> (capMasterCap cap = capMasterCap (cteCap cte) \<or> is_simple_cap' cap) \<and> is_aligned src 3 \<and> ((\<exists>cte. ctes_of s dest = Some cte) \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) src s \<and> (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) \<and> (isUntypedCap (cteCap cte) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap cte)) \<and> dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s) \<and> cte_wp_at' (\<lambda>_. True) dest s)) \<and> (\<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = ?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = ?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') rv \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0)))))) proof (prove)
goal (2 subgoals):
 1. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of s src = Some cte \<longrightarrow> ctes_of s (?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) cte) = Some cte \<and> ctes_of s (?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) cte (cteMDBNode cte)) = Some cte \<and> (capMasterCap cap = capMasterCap (cteCap cte) \<or> is_simple_cap' cap) \<and> is_aligned src 3 \<and> ((\<exists>cte. ctes_of s dest = Some cte) \<longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) src s \<and> (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) \<and> (isUntypedCap (cteCap cte) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap cte)) \<and> dest \<noteq> 0 \<and> src \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode cte)) s) \<and> cte_wp_at' (\<lambda>_. True) dest s)
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = ?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = ?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') rv \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (2 subgoals):
 1. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> (capMasterCap cap = capMasterCap (cteCap ctea) \<or> is_simple_cap' cap) \<and> ctes_of s (?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) ctea) = Some ctea \<and> ctes_of s (?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) ctea (cteMDBNode ctea)) = Some ctea \<and> ((\<exists>cte. ctes_of s dest = Some cte) \<longrightarrow> dest \<noteq> 0 \<and> (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte)))
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = ?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = ?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') rv \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (5 subgoals):
 1. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> capMasterCap cap = capMasterCap (cteCap ctea) \<or> is_simple_cap' cap
 2. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> ctes_of s (?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) ctea) = Some ctea
 3. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> ctes_of s (?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) ctea (cteMDBNode ctea)) = Some ctea
 4. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s dest = Some cte) \<longrightarrow> dest \<noteq> 0 \<and> (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 5. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = ?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = ?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') rv \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (4 subgoals):
 1. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> ctes_of s (?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) ctea) = Some ctea
 2. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> ctes_of s (?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) ctea (cteMDBNode ctea)) = Some ctea
 3. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s dest = Some cte) \<longrightarrow> dest \<noteq> 0 \<and> (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 4. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = ?ptr1766 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = ?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') rv \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> ctes_of s (?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) ctea (cteMDBNode ctea)) = Some ctea
 2. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s dest = Some cte) \<longrightarrow> dest \<noteq> 0 \<and> (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = ?ptr2122 newCap (cte_Ptr src) (cte_Ptr dest) (cte_to_H cte') rv \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (2 subgoals):
 1. \<And>newCap s s' ctea. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s dest = Some cte) \<longrightarrow> dest \<noteq> 0 \<and> (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (dest \<noteq> 0 \<longrightarrow> is_aligned dest 3) \<and> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (2 subgoals):
 1. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> (isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap) \<and> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> isUntypedCap cap \<longrightarrow> minUntypedSizeBits \<le> capBlockSize cap
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' ctea cte x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation (capability.UntypedCap x101 x102 x103 x104) (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' (capability.UntypedCap x101 x102 x103 x104) s; capMasterCap (cteCap ctea) = capability.UntypedCap x101 x102 x103 0 \<or> is_simple_cap' (capability.UntypedCap x101 x102 x103 x104); ctes_of s src = Some ctea; ctes_of s dest = Some cte; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> x103
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' ctea cte x101 x102 x103 x104. \<lbrakk>ccap_relation (capability.UntypedCap x101 x102 x103 x104) newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation (capability.UntypedCap x101 x102 x103 x104) (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' (capability.UntypedCap x101 x102 x103 x104) s; capMasterCap (cteCap ctea) = capability.UntypedCap x101 x102 x103 0 \<or> is_simple_cap' (capability.UntypedCap x101 x102 x103 x104); ctes_of s src = Some ctea; ctes_of s dest = Some cte; cap = capability.UntypedCap x101 x102 x103 x104; minUntypedSizeBits \<le> x103 \<and> is_aligned (word_of_nat x104) minUntypedSizeBits \<and> x103 \<le> maxUntypedSizeBits \<and> x103 < word_bits\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> x103
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (2 subgoals):
 1. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> (isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)) \<and> (mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte))
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte)
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' ctea cte x1 x2. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte; ctea = CTE x1 x2\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap ctea) \<longrightarrow> minUntypedSizeBits \<le> capBlockSize (cteCap ctea)
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte)
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' cte x2 x101 x102 x103 x104. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capability.UntypedCap x101 x102 x103 0 = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some (CTE (capability.UntypedCap x101 x102 x103 x104) x2); ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> x103
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte)
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (4 subgoals):
 1. \<And>newCap s s' cte x2 x101 x102 x103 x104. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capability.UntypedCap x101 x102 x103 0 = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some (CTE (capability.UntypedCap x101 x102 x103 x104) x2); ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>newCap s s' cte x2 x101 x102 x103 x104. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capability.UntypedCap x101 x102 x103 0 = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some (CTE (capability.UntypedCap x101 x102 x103 x104) x2); ctes_of s dest = Some cte; minUntypedSizeBits \<le> x103 \<and> is_aligned (word_of_nat x104) minUntypedSizeBits \<and> x103 \<le> maxUntypedSizeBits \<and> x103 < word_bits\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> x103
 3. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte)
 4. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' cte x2 x101 x102 x103 x104. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capability.UntypedCap x101 x102 x103 0 = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some (CTE (capability.UntypedCap x101 x102 x103 x104) x2); ctes_of s dest = Some cte; minUntypedSizeBits \<le> x103 \<and> is_aligned (word_of_nat x104) minUntypedSizeBits \<and> x103 \<le> maxUntypedSizeBits \<and> x103 < word_bits\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> x103
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctea) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte)
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (2 subgoals):
 1. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s src = Some ctea; ctes_of s dest = Some cte; mdbNext (cteMDBNode ctea) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (4 subgoals):
 1. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s dest = Some cte; mdbNext (cteMDBNode ctea) \<noteq> 0\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s)
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s dest = Some cte; mdbNext (cteMDBNode ctea) \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctea) \<noteq> 0
 3. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s dest = Some cte; mdbNext (cteMDBNode ctea) \<noteq> 0; \<exists>cte'. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte
 4. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (3 subgoals):
 1. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s dest = Some cte; mdbNext (cteMDBNode ctea) \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctea) \<noteq> 0
 2. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s dest = Some cte; mdbNext (cteMDBNode ctea) \<noteq> 0; \<exists>cte'. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte
 3. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (2 subgoals):
 1. \<And>newCap s s' ctea cte. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; pspace_aligned' s; ccap_relation cap (newCap_' s'); valid_mdb' s; destSlot_' s' = cte_Ptr dest; srcSlot_' s' = cte_Ptr src; valid_objs' s; valid_cap' cap s; capMasterCap (cteCap ctea) = capMasterCap cap \<or> is_simple_cap' cap; ctes_of s dest = Some cte; mdbNext (cteMDBNode ctea) \<noteq> 0; \<exists>cte'. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode ctea)) = Some cte
 2. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (1 subgoal):
 1. \<And>newCap srcSlot destSlot s s'. \<lbrakk>ccap_relation cap newCap; srcSlot = cte_Ptr src; destSlot = cte_Ptr dest; (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap cap \<or> is_simple_cap' cap) src s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>c. True) src s; destSlot_' s' = cte_Ptr dest \<and> srcSlot_' s' = cte_Ptr src \<and> ccap_relation cap (newCap_' s')\<rbrakk> \<Longrightarrow> \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr src) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> src = src \<and> (\<forall>rv. cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))) \<longrightarrow> src = src \<and> ((\<exists>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C''])))) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> (\<exists>t. mdb_node_lift (ret__struct_mdb_node_C_' t) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3\<rparr>) \<longrightarrow> (\<exists>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>) \<longrightarrow> (\<forall>ta. mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src && ~~ mask 3, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr> \<longrightarrow> (\<forall>newMDB. cmdbnode_relation newMDB (ret__struct_mdb_node_C_' ta) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift t) (cte_Ptr dest) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) \<and> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0 \<or> mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) = 0))))) proof (prove)
goal (1 subgoal):
 1. \<And>newCap s s' cte cte' k' rv rva t rvb ta tb tc newMDB cte'a k'a. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; destSlot_' s' = cte_Ptr dest; valid_mdb' s; capMasterCap (cteCap cte) = capMasterCap cap \<or> is_simple_cap' cap; srcSlot_' s' = cte_Ptr src; ccap_relation cap (newCap_' s'); valid_objs' s; pspace_aligned' s; valid_cap' cap s; ctes_of s src = Some cte; cl_valid_cte cte'; cslift s' (cte_Ptr src) = Some k'; cte_lift k' = Some cte'; cmdbnode_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C'']))); ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr src\<rightarrow>[''cap_C'']))); from_bool rvb = ret__unsigned_long_' t; mdb_node_lift (ret__struct_mdb_node_C_' ta) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src\<rparr>; mdb_node_lift (ret__struct_mdb_node_C_' tb) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>; mdb_node_lift (ret__struct_mdb_node_C_' tc) = mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))\<lparr>mdbPrev_CL := src, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr>; cmdbnode_relation newMDB (ret__struct_mdb_node_C_' tc); cl_valid_cte cte'a; cslift t (cte_Ptr dest) = Some k'a; cte_lift k'a = Some cte'a; mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))) \<noteq> 0\<rbrakk> \<Longrightarrow> &(cte_Ptr (mdbNext_CL (mdb_node_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (mdb_Ptr &(cte_Ptr src\<rightarrow>[''cteMDBNode_C''])))))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) proof (prove)
goal (1 subgoal):
 1. \<And>newCap s s' cte cte' k' rv rva t rvb ta tb tc newMDB cte'a k'a. \<lbrakk>ccap_relation cap newCap; (s, s') \<in> rf_sr; destSlot_' s' = cte_Ptr dest; valid_mdb' s; capMasterCap (cteCap cte) = capMasterCap cap \<or> is_simple_cap' cap; srcSlot_' s' = cte_Ptr src; ccap_relation cap (newCap_' s'); valid_objs' s; pspace_aligned' s; valid_cap' cap s; ctes_of s src = Some cte; cl_valid_cte cte'; cslift s' (cte_Ptr src) = Some k'; cte_lift k' = Some cte'; cmdbnode_relation rv (cteMDBNode_C k'); ccap_relation rva (cte_C.cap_C k'); from_bool rvb = ret__unsigned_long_' t; mdb_node_lift (ret__struct_mdb_node_C_' ta) = cteMDBNode_CL cte'\<lparr>mdbPrev_CL := src\<rparr>; mdb_node_lift (ret__struct_mdb_node_C_' tb) = cteMDBNode_CL cte'\<lparr>mdbPrev_CL := src, mdbRevocable_CL := ret__unsigned_long_' t && 1\<rparr>; mdb_node_lift (ret__struct_mdb_node_C_' tc) = cteMDBNode_CL cte'\<lparr>mdbPrev_CL := src, mdbRevocable_CL := ret__unsigned_long_' t && 1, mdbFirstBadged_CL := ret__unsigned_long_' t && 1\<rparr>; cmdbnode_relation newMDB (ret__struct_mdb_node_C_' tc); cl_valid_cte cte'a; cslift t (cte_Ptr dest) = Some k'a; cte_lift k'a = Some cte'a; mdbNext_CL (cteMDBNode_CL cte') \<noteq> 0\<rbrakk> \<Longrightarrow> &(cte_Ptr (mdbNext_CL (cteMDBNode_CL cte'))\<rightarrow>[''cteMDBNode_C'']) = &(cte_Ptr (mdbNext newMDB)\<rightarrow>[''cteMDBNode_C'']) proof (prove)
goal:
No subgoals!